File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:37
Security audit
GitHub API - Profiles, Repos, Issues, Search, Email Finder
Security checks across malware telemetry and agentic risk
Overview
This skill is a clearly disclosed wrapper for querying public GitHub data through Scavio, with no hidden install scripts or persistence.
Before installing, be aware that use requires a Scavio API key and consumes Scavio credits. Queries and public GitHub identifiers are sent to Scavio, and the public commit email endpoint can return personal data, so use that endpoint only for legitimate, user-directed purposes.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal