← back to cnb-pipeline

SkillSpector · cnb-pipeline

independent scanner by NVIDIA · skill by eryajf · how it works ↗

WARNINGmax severity: HIGHrisk score: 51

Without declared permissions the skill's intent is opaque and cannot be validated.; Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.; Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.; +1 more

scanned 2026-08-23

Findings (13)

MEDIUMMCP Least Privilegeconfidence: 0.7

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

HIGHPrivilege Escalationconfidence: 0.7

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

SKILL.md

HIGHPrivilege Escalationconfidence: 0.18

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.18

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.21

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.21

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.21

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.21

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/best-practices.md

HIGHPrivilege Escalationconfidence: 0.21

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/syntax-reference.md

LOWSupply Chainconfidence: 0.4

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

validator/package.json

LOWSupply Chainconfidence: 0.4

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

validator/package.json

LOWSupply Chainconfidence: 0.4

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

validator/package.json

HIGHSupply Chainconfidence: 0.8

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

validator/package.json

What the verdicts mean

SkillSpector reports on SkillMD's shared five-tier scale. See how SkillSpector works ↗.

PASS

Overall severity LOW (risk score in the safe range)

CAUTION

Overall severity MEDIUM

WARNINGthis skill

Overall severity HIGH

FAIL

Overall severity CRITICAL

INCONCLUSIVE

Scan could not complete