SkillSpector · busco-assessor

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

busco_assessor.py

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

busco_assessor.py

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

busco_assessor.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

busco_assessor.py

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

tests/test_busco_assessor.py

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

tests/test_busco_assessor.py

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

tests/test_busco_assessor.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

busco_assessor.py