SkillSpector · vss-manage-alerts

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/alert-notify/open_claw_dashboard_notifier.py

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/alert-notify/open_claw_dashboard_notifier.py

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

scripts/alert-notify/slack_notifier.py

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

scripts/alert-notify/server.py

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

scripts/alert-notify/requirements.txt

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

skill.oms.sig

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

scripts/alert-notify/requirements.txt

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

scripts/alert-notify/requirements.txt

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

references/alert-subscriptions.md

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

references/alert-subscriptions.md