Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/pua.py:103
Security audit
npm defender2
Security checks across malware telemetry and agentic risk
Overview
This skill is a local npm malware scanner whose file-reading behavior matches its stated purpose.
Install it in an isolated environment if possible, verify the unpinned rlo-detect dependency before using that optional command, and scan only npm projects or package directories you intend to inspect because local file names and decoded snippets may be printed.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dynamic_code_execution