Security audit

Dev Glue

Security checks for vulnerabilities and agentic risk

Overview

This is a small developer utility skill that clearly describes paid remote API-style services, with privacy and payment cautions users should understand first.

Install only if you are comfortable sending the specific data you provide to an external paid service. Avoid submitting secrets, private customer data, regulated documents, or proprietary material unless you trust the operator and understand its data handling, and keep a confirmation or budget limit around paid x402 calls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill advertises text, JSON, and document-processing operations via remote HTTP micro-services but does not warn that supplied contents will be transmitted off-box to external endpoints. This can cause an agent or user to send sensitive documents, secrets, or personal data to third-party services without informed consent, creating confidentiality and compliance risk.

Static analysis

No suspicious patterns detected.