SkillSpector · qveris
independent scanner by NVIDIA · skill by johnalbertini14-glitch · how it works ↗
Without declared permissions the skill's intent is opaque and cannot be validated.; Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.; Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.; +1 more
scanned 2026-08-22
Findings (7)
Without declared permissions the skill's intent is opaque and cannot be validated.
SKILL.md
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
SKILL.md
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
SKILL.md
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
SKILL.md
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
SKILL.md
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.
scripts/qveris_tool.py
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
pyproject.toml
What the verdicts mean
SkillSpector reports on SkillMD's shared five-tier scale. See how SkillSpector works ↗.
Overall severity LOW (risk score in the safe range)
Overall severity MEDIUM
Overall severity HIGH
Overall severity CRITICAL
Scan could not complete