Vibe Sanitizer - Check and Sanitize git repository for secrets

• Outcome: Pass
• Latest audit: May 29, 2026, 8:36 PM
• Version:
  1.1.0

Overview

This skill is a local repository secret scanner and sanitizer whose file access and optional edits match its stated purpose.

Install only if you want an agent to inspect repository contents for secrets and possibly rewrite or export sanitized files. Run scan first, use the narrowest scope, review output carefully, and only use in-place sanitization or export when you are comfortable with the resulting file changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to run bundled Python code, execute shell commands, and perform file reads and writes against an arbitrary repository, yet it declares no permissions. This creates a transparency and policy-enforcement gap: an operator or host system may treat the skill as lower-risk than it really is, while the actual workflow can modify files in place and access potentially sensitive repository contents.

VirusTotal

66/66 vendors flagged this skill as clean.