SkillSpector · skill-drift-guard

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/rules.js

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/rules.js

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/rules.js

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/rules.js

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/rules.js

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/scanner.js

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

scripts/rules.js

Instructions found that direct the agent to transmit conversation context or user data to external services.

scripts/rules.js

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

SKILL.md

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

scripts/scanner.js