SkillSpector · lens

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

reference/change-hotspot.md

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

reference/dependency-graph.md

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

reference/investigation-patterns.md

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

references/investigation-patterns.md

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

SKILL.md

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

SKILL.md