SkillSpector · monday

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/register.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/register.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/register.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/register.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

SKILL.md

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/register.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/register.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/register.py

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/register.py

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/register.py