Known Vulnerable Dependency: nanoid==5.0.4 — 1 advisory(ies): CVE-2024-55565 (Predictable results in nanoid generation when given non-integer values)
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
- nanoid==5.0.4
Security audit
Arbiter
Security checks across malware telemetry and agentic risk
Overview
The skill appears to be a narrowly scoped local review-queue helper, with only a dependency hygiene issue to consider.
This looks acceptable to install if you want a local file-based human-review queue. Review that ~/.arbiter/queue/ may contain decision context from your agent sessions, keep that directory private, and prefer an updated release that bumps nanoid before relying on queue IDs for anything security-sensitive.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
VirusTotal
60/60 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.