Security audit
Security checks across malware telemetry and agentic risk
Nella is a coherent code-search skill, but it deserves Review because normal use can send repository content and usage metadata to remote services while storing credentials and context locally.
Install only if you are comfortable with a codebase-indexing tool that may send source snippets and search results to configured remote embedding/reranking services, logs usage metadata when authenticated, and stores tokens plus persistent context locally. Prefer local-only or tightly scoped provider settings for private repositories, pin the npm version, avoid service-role credentials except for deliberate self-hosting, keep hosted servers bound to localhost unless intentionally exposed, and review or rotate any API keys written into agent config files.
body.retry = "300";
body.expire = "3600";
}
await fetch("https://api.pushover.net/1/messages.json", {
method: "POST",
body: new URLSearchParams(body)
});body.retry = "300";
body.expire = "3600";
}
await fetch("https://api.pushover.net/1/messages.json", {
method: "POST",
body: new URLSearchParams(body)
});body.retry = "300";
body.expire = "3600";
}
await fetch("https://api.pushover.net/1/messages.json", {
method: "POST",
body: new URLSearchParams(body)
});body.retry = "300";
body.expire = "3600";
}
await fetch("https://api.pushover.net/1/messages.json", {
method: "POST",
body: new URLSearchParams(body)
});var import_types2 = require("@modelcontextprotocol/sdk/types.js");
var import_core6 = __toESM(require_dist());
var import_ioredis = __toESM(require("ioredis"));
import_dotenv.default.config({ path: path7.resolve(__dirname, "../../../../.env") });
import_dotenv.default.config();
var pkgVersion2 = "0.0.0";
try {64/64 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)