SkillSpector · nick-saban

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

scripts/verify_resolution.py

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

scripts/verify_resolution.py

Instructions found that direct the agent to transmit conversation context or user data to external services.

references/decline.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

references/state.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

scripts/verify_resolution.py

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

references/state.md