SkillSpector · alterlab-citation-verifier

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/claim_faithfulness.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/claim_faithfulness.py

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

scripts/claim_faithfulness.py

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/claim_faithfulness.py

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/claim_faithfulness.py

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/verify_citations.py

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/claim_faithfulness.py

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/claim_faithfulness.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/claim_faithfulness.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/claim_faithfulness.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/verify_citations.py

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

scripts/claim_faithfulness.py

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

scripts/claim_faithfulness.py

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

scripts/claim_faithfulness.py