Security audit

eventlint

Security checks across malware telemetry and agentic risk

Overview

EventLint is mostly a local code scanner, but its license handling and optional git-hook installation create review-worthy local execution and persistence risks.

Review before installing. Free local scans appear purpose-aligned, but avoid untrusted license keys and avoid paid-tier/status/report/hook commands until the license parser is fixed. Enable git hooks only in repositories where automatic EventLint checks and possible commit/push blocking are intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

High

Confidence: 81% confidence
Finding: This code modifies repository hook configuration files and installs git hooks, which is a persistence-adjacent capability not justified by the stated analyzer purpose. Even though it is gated behind an explicit 'hooks install' command, altering repo execution paths can surprise users, create trust-boundary issues, and cause future code execution from repository events.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The license key supplied on the command line is exported into the environment, increasing its exposure to child processes and process-inspection surfaces. In this script, that matters because subsequent sourced modules and hook-related flows may invoke other tools, broadening the chance of accidental disclosure or misuse of the credential.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.