Skill Scanner · metabot-llm-wiki

independent scanner by Cisco AI Defense · skill by openagentinternet · how it works ↗

FAILmax severity: CRITICAL

Skill does not specify a license; Node.js filesystem access that could read or write sensitive data; Node.js child_process module usage for shell command execution; +2 more

scanned 2026-08-22

Findings (20)

INFOpolicy_violation

Skill does not specify a license

SKILL.md

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:107

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:115

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:120

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:137

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:149

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:401

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\index.js:596

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\index.js:610

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:656

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\index.js:812

MEDIUMdata_exfiltration

Outbound network request primitives in JavaScript/TypeScript

scripts\index.js:2269

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:2383

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:2384

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:2385

MEDIUMobfuscation

XOR used in decode/execute context (possible obfuscation)

scripts\index.js:2439

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:2524

HIGHdata_exfiltration

Node.js filesystem access that could read or write sensitive data

scripts\index.js:2551

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\index.js:2681

CRITICALcommand_injection

Node.js child_process module usage for shell command execution

scripts\self-test.js:13

What the verdicts mean

Skill Scanner reports on SkillMD's shared five-tier scale. See how Skill Scanner works ↗.

PASS

Reported as safe — no findings

CAUTION

Findings up to MEDIUM severity

WARNING

Findings of HIGH severity

FAILthis skill

Findings of CRITICAL severity

INCONCLUSIVE

Scan could not complete