SkillSpector · alpaca

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/alpaca_cli.py

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/alpaca_cli.py

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

scripts/alpaca_cli.py

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

references/api.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

references/api.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

references/api.md