SkillSpector · skill-comply

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/classifier.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/runner.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/runner.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/runner.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/scenario_generator.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

SKILL.md

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/classifier.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/runner.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/runner.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/scenario_generator.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/spec_generator.py

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

pyproject.toml

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

pyproject.toml