File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:40
Security audit
Google Play
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed Google Play data lookup integration that may spend credits or x402 payments when the user chooses to call the external API.
Before installing, confirm you are comfortable using fetcher.sh as a paid third-party data provider. Keep the bearer key private, understand that calls are billed at the documented rate or via x402 payment, and note the artifact says upstream failures are not refunded after settlement.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
60/60 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal