File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:40
Security audit
URL to Markdown - Web Page Extract API
Security checks across malware telemetry and agentic risk
Overview
This skill is a straightforward third-party URL extraction helper with its API-key use, pricing, limits, and guardrails clearly disclosed.
Install this only if you are comfortable sending the URLs you ask it to fetch, and resulting page content, to Scavio under your API key and credit balance. Avoid using it for private or sensitive URLs unless that sharing is intended.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
45/45 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal