SkillSpector · instagram

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/auth.py

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

scripts/config.py

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/requirements.txt

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

scripts/requirements.txt

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

references/graph_api.md