SkillSpector · cinematic-3d-website

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

references/gen_depth.py

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

references/gen_stills.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

references/depth-fly-engine.tsx

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

references/editorial-fusion-template.tsx

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

references/editorial-fusion-template.tsx

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/gen_depth.py

Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

references/gen_stills.py

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

LICENSE