Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/resolve-handoff.mjs:34
Security audit
doc-bridge-handoff
Security checks across malware telemetry and agentic risk
Overview
This skill coherently routes coding agents to repository documentation and edit boundaries before changes, with no hidden persistence or credential handling found.
Before installing, be aware that the fallback path may download and run the pinned Doc Bridge CLI through npx, and it tells the agent to run project-defined check commands after resolving a route. This is expected for the skill's purpose, but you should only use it in repositories whose Doc Bridge configuration you trust.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dangerous_exec