SkillSpector · readme

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

SKILL.md

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

SKILL.md

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

SKILL.md

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

SKILL.md

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

SKILL.md

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

SKILL.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

SKILL.md

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

SKILL.md