Repo Insights

• Outcome: Review
• Latest audit: May 28, 2026 · 2:49 PM UTC
• Version: 1.1.0

Overview

The skill does what it advertises, but its hosted mode asks users to send a raw Anthropic API key to a third-party service without enough disclosure or key-handling controls.

Self-hosting is the safer mode because your Anthropic key stays under your control. Do not send a long-lived or high-limit Anthropic API key to the hosted MeshCore endpoint unless you trust the operator and have verified its logging, retention, billing, and key-handling practices. Use a scoped, revocable key if possible, and pin dependencies before operating the service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The service requires callers to send a raw Anthropic API key to the skill, which unnecessarily expands trust and gives the service access to a sensitive credential unrelated to GitHub fetching itself. If the service is logged, compromised, or modified, user API keys could be stolen or misused for unauthorized model usage and billing.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to place a sensitive Anthropic API key directly in the JSON request body when calling a third-party hosted service. Secrets in request bodies are commonly captured by proxies, application logs, analytics, debugging middleware, and upstream operators, so this creates unnecessary credential exposure risk and hands a user secret to an external service not clearly scoped or trusted for key handling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
requests
anthropic
gunicorn

• Confidence: 98% confidence
• Finding: The dependency list leaves Flask unpinned, allowing builds to resolve to different versions over time. This creates supply-chain and patch-management risk because deployments may silently pick up incompatible or vulnerable releases, especially in a network-exposed Flask API.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
requests
anthropic
gunicorn

• Confidence: 98% confidence
• Finding: Requests is unpinned, so future installs may pull different versions than those originally tested. For a service with network access that likely makes outbound HTTP requests, this increases the chance of inheriting vulnerable or behavior-changing releases without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
requests
anthropic
gunicorn

• Confidence: 98% confidence
• Finding: Anthropic is unpinned, which makes the exact SDK version nondeterministic across environments. Because this package interfaces with an external AI service and may handle prompts, responses, and local files, unexpected version changes can introduce security regressions or break assumptions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

flask
requests
anthropic
gunicorn

• Confidence: 98% confidence
• Finding: Gunicorn is unpinned, so the production WSGI server version may drift across installs. For an Internet-facing Flask API, uncontrolled upgrades or downgrades can expose the service to known request parsing or smuggling issues and complicate incident response.

Known Vulnerable Dependency: flask — 8 advisory(ies): CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +5 more

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: The file allows installation of Flask versions with multiple known advisories, and because the dependency is unpinned, vulnerable versions may be selected. In a network-accessible Flask API, framework flaws can directly affect request handling, session security, or availability, making the context materially more dangerous.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Requests has multiple known advisories, and an unpinned dependency means the deployed service could resolve to an affected version. Since this skill is designed to analyze GitHub repositories and likely performs outbound HTTP requests on user-influenced URLs, issues like credential leakage or improper verification are especially relevant.

Known Vulnerable Dependency: anthropic — 2 advisory(ies): CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox)

Low

• Category: Supply Chain
• Confidence: 71% confidence
• Finding: The anthropic SDK is reported with security advisories, and because the dependency is not pinned, affected versions may be installed. The exact impact depends on whether the application uses the vulnerable features, but an AI-facing service may process local files or tool interactions, so the risk should not be ignored.

Known Vulnerable Dependency: gunicorn — 4 advisory(ies): CVE-2018-1000164 (Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers); CVE-2024-6827 (Gunicorn HTTP Request/Response Smuggling vulnerability); CVE-2024-1135 (Request smuggling leading to endpoint restriction bypass in Gunicorn) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Gunicorn has known advisories including request smuggling-related issues, and the dependency is unpinned in a publicly exposed Flask API stack. Because Gunicorn sits at the HTTP serving layer, exploitable flaws can enable cache poisoning, access-control bypass, desync attacks, or service disruption.

Static analysis

No suspicious patterns detected.