Security audit
Scratch Blocks
Security checks for vulnerabilities and agentic risk
Overview
This skill locally renders Scratch project files into readable ASCII blocks and does not request credentials, networking, or unrelated access.
Before installing, be comfortable with the agent running the bundled local Python scripts on Scratch files you provide. The main residual consideration is local output left in /tmp/scratchcode or beside raw JSON inputs; delete those generated files if you do not want them retained.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.