File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:332
Security audit
test2
Security checks across malware telemetry and agentic risk
Overview
This skill is a normal NestJS and TypeORM setup guide, with database-change and example-password cautions but no hidden or unrelated behavior.
Before using this skill, review generated migrations before running them, test database changes outside production, and replace example database credentials with real secrets stored in environment variables or a secret manager.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.exposed_secret_literal