BYR CLI Skill

• Outcome: Review
• Latest audit: May 27, 2026 at 10:45 PM UTC
• Version:
  0.1.2

Overview

The skill is mostly coherent, but it can direct an agent to import BYR session cookies from browser profiles through an external CLI without enough scoping or credential-handling detail.

Install only if you trust the `byr-pt-cli` binary and understand that browser import can access sensitive session cookies. Prefer manually supplied, minimal BYR cookies where possible, avoid sharing or logging cookie/token values, review dry-run output before downloads, and use `byr auth logout --json` when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file includes commands that import raw authentication cookies and browser-derived session tokens, which are sensitive credentials. The examples present these operations plainly without any surrounding warning about credential sensitivity, secure handling, or the risk of exposing session data.

VirusTotal

65/65 vendors flagged this skill as clean.