Security Sentinel
Security checks across malware telemetry and agentic risk
Overview
The skill's code, instructions, and requirements are coherent with its stated purpose (workspace security scanning); it reads files and runs npm audit as expected and does not request unrelated credentials or external endpoints.
This skill appears to do what it says: it reads workspace files to look for secrets, runs npm audit, and checks permissions. Before installing or running it, consider: 1) it will read many files in your workspace (so don't run it in environments with extremely sensitive files you don't want scanned); 2) index.js spawns 'npm audit' which may perform network activity via npm (expected for dependency checks); 3) scan.js intentionally skips .env file contents (but still checks .env file permissions) — if you expect .env secret detection, this is a gap; 4) the scanner prints matches to stdout, which could surface secrets in logs/CI; treat its output as sensitive. If you are comfortable with those behaviors, the skill is coherent with its description.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings