Base64

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This appears to be an offline reference skill that only prints static documentation, with minor documentation/version inconsistencies but no evidence of credential use, network access, persistence, or data mutation.

This skill appears safe to install from the provided artifacts as a static offline reference, but its documentation is generic and version labels are inconsistent, so verify the source if accuracy or release provenance matters.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI09: Human-Agent Trust Exploitation
Low
What this means

A user could be confused by generic guidance that does not match the advertised Base64 reference purpose.

Why it was flagged

The script output mentions access credentials even though SKILL.md says no API keys or credentials are required; this is likely generic reference text, but users should not interpret it as a real credential requirement for this skill.

Skill content
## Prerequisites
- Basic understanding of devtools concepts
- Required tools and access credentials
Recommendation

Treat the output as general documentation only, and do not provide credentials or make system changes unless separately required by your own task.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

Version mismatch may make it harder to confirm exactly which release or documentation set is installed.

Why it was flagged

The registry metadata lists version 2.0.4 while SKILL.md lists 2.0.3 and scripts/script.sh defines VERSION="2.0.2", indicating minor package/version provenance inconsistency.

Skill content
version: "2.0.3"
Recommendation

If version provenance matters, verify the package source and release contents before relying on the skill.