Security audit

Code Fix

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward debugging skill whose file access, shell commands, and code-editing abilities fit its stated purpose, with some commands users should run carefully.

Install this only if you want an agent to help debug and edit code. Before allowing cache cleanup, dependency reinstall, or .env comparison, confirm the project directory, understand what will be removed or changed, and redact secrets such as API keys, passwords, and tokens.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill includes destructive cleanup commands such as removing dependency directories and clearing caches without an explicit warning about side effects. In a debugging skill, users may copy these commands directly, which can delete local state, invalidate environments, or cause data loss if run in the wrong directory or with modified paths.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill advises comparing development, test, and production `.env` files without warning that these files often contain secrets such as API keys, passwords, and tokens. In practice, this can encourage unnecessary exposure of sensitive configuration data in chat, logs, screenshots, or shared diffs during debugging.

Static analysis

No suspicious patterns detected.