SkillSpector · ivx-om-heygen

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/video-status.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/assets.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/avatars.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/photo-avatars.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/quota.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/templates.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/templates.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/video-agent.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/video-generation.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/video-status.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/voices.md

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

SKILL.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

SKILL.md

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

references/webhooks.md