SkillSpector · alterlab-brenda

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

scripts/brenda_client.py

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/brenda_client.py

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/brenda_client.py

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/brenda_queries.py

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/brenda_client.py

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/brenda_client.py

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

scripts/brenda_queries.py

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

scripts/enzyme_pathway_builder.py

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/brenda_client.py