Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- src/sources/knowledgeBase.js:42
Security audit
The Synthetic Context Generator
Security checks across malware telemetry and agentic risk
Overview
SCG appears to be a purpose-aligned coding context tool, but it can read user-selected project files and send task keywords to StackOverflow, so use it carefully with sensitive work.
Treat this as a local developer CLI: verify the source before npm install/npm link, run it on narrow directories, avoid secrets in task prompts or indexed files, review generated context before sharing it with an AI assistant, and use --no-web for sensitive tasks.
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/sources/knowledgeBase.js:131
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/sources/knowledgeBase.js:653