runbook-generator

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only DevOps runbook skill with visible, purpose-aligned operational commands, but users should handle generated staging environment files and production commands carefully.

Install only for repositories you are comfortable having analyzed. Treat generated runbooks as drafts: review commands before running them, test in staging first, protect any pulled .env files from commits or sharing, restrict file permissions, delete local secret files when no longer needed, and get an experienced operator to approve production deployment, rollback, or database commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to run `vercel env pull .env.staging` and then `source .env.staging`, which pulls sensitive environment variables into a local plaintext file without warning about secret handling, file permissions, cleanup, or accidental commit risk. In a DevOps/SRE skill, this is especially risky because the file may contain production-adjacent credentials and operators are likely to execute the commands as written during incident or staging workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal