firmenbuchat

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward Firmenbuch API CLI helper, with the main caution being careful handling of its API key.

Install only if you trust the publisher and the referenced GitHub/Homebrew source. Prefer storing the API key in the tool's config or a protected environment file rather than passing it directly on the command line, and avoid committing any local secret files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The documentation encourages supplying an API key via environment variables, config storage, and direct command-line options, but provides no warning about common exposure paths such as shell history, process listings, accidental logging, or committing .env files. While this is documentation rather than executable code, it can still lead users to handle credentials unsafely and increase the chance of credential leakage.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal