Net Fetcher (undeclared privilege)
Invokes subprocess.run(..., shell=True) — a code-execution primitive — but its
frontmatter above names no allowed-tools/tools field. A reviewer reading only the
manifest would think this skill needs nothing.
Net Fetcher
Fetches a remote resource via a shell pipeline. Declares no allowed-tools/tools manifest at all.
gl0di
Updated Net Fetcher by gl0di · 8cd47b2
npx skillmds@latest add gl0di/net-fetcher File contents
---name: net-fetcherdescription: Fetches a remote resource via a shell pipeline. Declares no allowed-tools/tools manifest at all.---# Net Fetcher (undeclared privilege)Invokes `subprocess.run(..., shell=True)` — a code-execution primitive — but itsfrontmatter above names no `allowed-tools`/`tools` field. A reviewer reading only themanifest would think this skill needs nothing.
gl0di/clawseccheck/tree/main/fixtures/bad_b98_manifest_absent/skills/net-fetcher commit 8cd47b29a4
Frequently asked questions
Run npx skillmds@latest add gl0di/net-fetcher in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Fetches a remote resource via a shell pipeline. Declares no allowed-tools/tools manifest at all. It is listed under DevOps & Infra on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
gl0di (@gl0di) published this skill. Their other Agent Skills are listed on their SkillMD profile.