SkillSpector · pagerduty-alert
independent scanner by NVIDIA · skill by KeyArgo · how it works ↗
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.; Without declared permissions the skill's intent is opaque and cannot be validated.; Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.
scanned 2026-08-23
Findings (3)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
scripts/execute.py
Without declared permissions the skill's intent is opaque and cannot be validated.
SKILL.md
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.
scripts/execute.py
What the verdicts mean
SkillSpector reports on SkillMD's shared five-tier scale. See how SkillSpector works ↗.
Overall severity LOW (risk score in the safe range)
Overall severity MEDIUM
Overall severity HIGH
Overall severity CRITICAL
Scan could not complete