SkillSpector · jetson-customize-pinmux

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

scripts/generate_dtsi.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

BENCHMARK.md

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

BENCHMARK.md

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

BENCHMARK.md

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

scripts/generate_dtsi.py

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

scripts/generate_dtsi.py

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

scripts/modify_pinmux.py

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig