SkillSpector · alterlab-zinc-db
independent scanner by NVIDIA · skill by AlterLab-IEU · how it works ↗
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.; Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks an…
scanned 2026-08-23
Findings (3)
The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
scripts/query_zinc.py
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
SKILL.md
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
references/api_reference.md
What the verdicts mean
SkillSpector reports on SkillMD's shared five-tier scale. See how SkillSpector works ↗.
Overall severity LOW (risk score in the safe range)
Overall severity MEDIUM
Overall severity HIGH
Overall severity CRITICAL
Scan could not complete