featurelint

Security checks across malware telemetry and agentic risk

Overview

FeatureLint is a local code-scanning skill whose licensing behavior is mostly disclosed and proportionate, with caution around license-key validation and local caching.

Install only if you are comfortable running a local shell-based scanner over the chosen code directory. Avoid scanning folders with secrets if reports may be saved or shared, because findings can include source snippets. If you set FEATURELINT_LICENSE_KEY, expect it to be sent to FeatureLint for validation and cached locally in your home directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The offline 'validation' path does not verify that a license was issued by a trusted authority. It deterministically assigns paid tiers from attacker-controlled input such as the FEATURELINT-PRO/TEAM prefix or a locally computed hash, so anyone can mint a syntactically valid key and obtain Pro/Team features when offline or when online validation fails.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The script sends the full license key to a remote service during validation without clear user-facing notice or consent at the time of transmission. While this is not code execution, it exposes a credential-like secret to an external party and may violate user expectations, privacy requirements, or internal data-handling rules.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal