SkillSpector · last30days

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/evaluate_search_quality.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/evaluate_search_quality.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/evaluate_search_quality.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/chrome_cookies.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/chrome_cookies.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/env.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/github.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/setup_wizard.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/setup_wizard.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/setup_wizard.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/subproc.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/xurl_x.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/lib/xurl_x.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/verify_v3.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/verify_v3.py

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/watchlist.py

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

scripts/lib/env.py

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/evaluate_search_quality.py

The skill uses 'mcp' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

scripts/lib/bluesky.py

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

SKILL.md