File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/self_check.py:32
Security audit
LYGO Skill Gate
Security checks across malware telemetry and agentic risk
Overview
This skill is a local, user-run scanner for other skills, and its artifacts match that purpose without hidden network, subprocess, install, or persistence behavior.
Install only if you want a local heuristic scanner for reviewing skill packages. It can read the skill folder you point it at and, with explicit consent, write a JSON report under its own state directory; its findings are best treated as review signals rather than proof that a skill is safe or unsafe.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal