GitHub Trending Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent GitHub trending notification purpose, but it exposes payment and subscription data through unsafe defaults and ships a live-looking payment API key.

Review this carefully before installing or publishing. Replace and rotate the SkillPay key, add authentication and object-level authorization to all subscription and payment routes, verify payment callbacks with the provider, add rate limits, disclose third-party data sharing, escape email content, and commit a reviewed lockfile.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.json:15
• Finding: Hardcoded SkillPay API Credential Published in Project Files<![CDATA[ ## Vulnerability Details **File Location**: `skill.json:15`; secondary exposure at `README.md:83-86` **Vulnerability Type**: Hardcoded secret exposure **Risk Level**: High ### Vulnerable Code `skill.json:15`: ```json "apiKey": "sk_e390b52cb259fc4f4aa1489547a48375d72876acdee75de57101d9e0e833fcb7", ``` `README.md:83-86`: ```env # SkillPay API Key (Required) SKILLPAY_API_KEY=sk_e390b52cb259fc4f4aa1489547a48375d72876acdee75de57101d9e0e833fcb7 ``` ### Technical Analysis An API-key-shaped SkillPay credential is embedded directly in both project metadata and public-facing documentation. The documentation also describes the key as already configured. At runtime, the application uses `SKILLPAY_API_KEY` as a Bearer credential in outbound requests to the SkillPay API. Consequently, if the embedded value is valid or was valid at any point, anyone with access to the package or repository history can recover and reuse it. Removing the key only from the current revision would not be sufficient because it may remain in package archives, mirrors, caches, and version-control history. ### Attack Path 1. An attacker downloads or inspects the Skill package. 2. The attacker extracts the key from `skill.json` or `README.md`. 3. The attacker sends requests to SkillPay API endpoints using the key as a Bearer token. 4. The attacker gains whichever API capabilities and billing access are assigned to that credential. ### Impact Assessment The exact provider-side privileges cannot be determined from the repository. Potential impact includes: - Impersonation of the SkillPay account or application. - Unauthorized payment verification, payment-request, or usage-logging operations. - Consumption of account quota or creation of fraudulent accounting records. - Exposure of provider-side data accessible to the key. - Financial or service disruption within the scope granted to the credential. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed credential immediately. 2. Remove the credential from `skill.json`, `README.md`, release archives, and version-control history. 3. Inject the credential only at deployment time through a secrets manager or protected environment variable. 4. Replace documentation values with unmistakable placeholders such as `SKILLPAY_API_KEY=replace_with_your_key`. 5. Apply least-privilege restrictions, expiration, and source restrictions to the replacement credential where supported. 6. Add automated secret scanning to pre-commit hooks and CI. 7. Review SkillPay audit logs for unauthorized activity involving the exposed key. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.js:190
• Finding: Unauthenticated Payment Callback Allows Unpaid Subscription Activation<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:190-200` **Vulnerability Type**: Missing callback authentication and payment-state forgery **Risk Level**: Critical ### Vulnerable Code ```js // Payment callback this.app.post('/payment/callback', async (req, res) => { try { const { userId, paymentId, status } = req.body; if (status === 'completed') { const subscription = this.subscriptions.get(userId); if (subscription && subscription.paymentId === paymentId) { subscription.status = 'active'; this.subscriptions.set(userId, subscription); } } res.json({ success: true }); ``` The payment identifier needed to satisfy the comparison is returned by the subscription endpoint: ```js this.subscriptions.set(userId, { channels, preferences: { language: preferences.language || '', since: preferences.since || 'daily', schedule: preferences.schedule || process.env.SCHEDULE || '0 9 * * *' }, status: 'pending', paymentId: paymentRequest.paymentId, createdAt: new Date().toISOString() }); res.json({ success: true, message: 'Subscription created, please complete payment', payment: paymentRequest }); ``` ### Technical Analysis The callback trusts the client-controlled `status`, `userId`, and `paymentId` fields. It does not verify: - A provider-generated signature or message authentication code. - A shared webhook secret. - The callback source. - The payment status directly with SkillPay. - The expected amount and currency. - Replay or duplicate callback identifiers. - Whether the payment was already consumed. Because `/subscribe` returns the payment request, a caller can obtain the matching payment ID and then independently claim that the payment was completed. ### Attack Path 1. Submit `POST /subscribe` with an arbitrary `userId` and attacker-selected notification channels. 2. Read `payment.paymentId` from the response. 3. Without completing payment, submit: ```http ...[truncated 815 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Authenticate callbacks using a provider-issued signing secret and verify the signature over the exact raw request body. 2. Reject unsigned callbacks, invalid signatures, stale timestamps, and previously processed event IDs. 3. Query the payment provider server-to-server before activation and verify: - Payment status. - Payment ID. - Expected user/account. - Exact amount. - Currency. - Merchant or Skill identity. 4. Store payment state in durable storage with a uniqueness constraint and atomic state transitions. 5. Permit only a transition from a valid `pending` state to `active`. 6. Return generic errors and log failed verification attempts without logging credentials. 7. Add integration tests proving that forged, replayed, mismatched, and underpaid callbacks are rejected. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.js:161
• Finding: Missing Object-Level Authorization Exposes and Modifies Other Users' Subscriptions<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:161-185`; related creation logic at `src/index.js:126-151` **Vulnerability Type**: Insecure direct object reference and missing authentication **Risk Level**: High ### Vulnerable Code ```js // Unsubscribe this.app.post('/unsubscribe', async (req, res) => { try { const { userId } = req.body; if (!userId) { return res.status(400).json({ error: 'Missing userId' }); } this.subscriptions.delete(userId); res.json({ success: true, message: 'Subscription cancelled' }); } catch (error) { console.error('Unsubscribe endpoint error:', error); res.status(500).json({ error: error.message }); } }); // Get subscription status this.app.get('/subscription/:userId', (req, res) => { const { userId } = req.params; const subscription = this.subscriptions.get(userId); if (!subscription) { return res.status(404).json({ error: 'Subscription not found' }); } res.json({ success: true, subscription }); }); ``` Subscription creation also trusts a caller-supplied identity and replaces any existing entry with the same identifier: ```js const { userId, channels, preferences = {} } = req.body; if (!userId || !channels) { return res.status(400).json({ error: 'Missing required fields: userId, channels' }); } const paymentRequest = await this.payment.createPaymentRequest(userId); this.subscriptions.set(userId, { channels, preferences: { language: preferences.language || '', since: preferences.since || 'daily', schedule: preferences.schedule || process.env.SCHEDULE || '0 9 * * *' }, status: 'pending', paymentId: paymentRequest.paymentId, createdAt: new Date().toISOString() }); ``` ### Technical Analysis No authentication middleware is applied to the subscription endpoints. The application treats the `userId` supplied in the URL or request body as authoritative identity. There is therefore no binding between th ...[truncated 1322 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authentication for all subscription creation, retrieval, modification, and deletion operations. 2. Derive the user identifier from a validated session or access token; do not accept it as authoritative request data. 3. Enforce object-level authorization before returning or changing a subscription. 4. Use non-enumerable internal subscription identifiers in addition to ownership checks. 5. Prevent unintentional replacement by using explicit update operations and conditional database writes. 6. Return only minimal status information; do not expose channel details or payment identifiers unless required. 7. Add audit logs and alerts for repeated access to nonexistent or unauthorized identifiers. 8. Add tests covering cross-user reads, overwrites, cancellation, and forged identities. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/notifiers/email.js:91
• Finding: Unescaped Repository and Request Data Enables HTML Injection in Email Reports<![CDATA[ ## Vulnerability Details **File Location**: `src/notifiers/email.js:91-106` **Vulnerability Type**: HTML content injection **Risk Level**: Medium ### Vulnerable Code ```js <div class="header"> <h1>🔥 GitHub Trending - ${timeLabel}</h1> <p>${language && language !== 'all' ? `Language: ${language}` : 'All Languages'}</p> <p>${new Date().toLocaleDateString('en-US', { year: 'numeric', month: 'long', day: 'numeric' })}</p> </div> `; if (!repos || repos.length === 0) { html += '<div class="repo"><p>❌ No trending repositories found.</p></div>'; } else { repos.slice(0, 10).forEach((repo, index) => { html += ` <div class="repo"> <div class="repo-title"> ${index + 1}. <a href="${repo.url}" target="_blank">${repo.fullName}</a> </div> <div class="repo-desc">${repo.description || 'No description provided.'}</div> ``` Additional unescaped values are inserted later in the same template: ```js ${repo.language ? `<div class="stat">💻 <span class="stat-value">${repo.language}</span></div>` : ''} ``` ### Technical Analysis The email formatter creates HTML through string interpolation but does not perform contextual encoding. It inserts: - Request-controlled `language`. - GitHub-derived `repo.fullName`. - GitHub-derived `repo.description`. - GitHub-derived `repo.language`. - `repo.url` into an HTML attribute. Repository descriptions and names are externally controlled by GitHub repository owners. The `language` preference is directly controlled through API requests. Inserting those values without HTML escaping allows markup to alter the generated email body. Although many email clients restrict script execution, HTML injection can still produce misleading content, hidden elements, remote image tracking, or phishing-style links. Attribute values require URL validation in addition to ordinary text escaping. ### Attack Path 1. An attacker supplies crafted HTML in the `language` field, or controls repository ...[truncated 812 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. HTML-escape every untrusted text value before interpolation, including `language`, repository names, descriptions, and language labels. 2. Apply attribute-specific encoding to values placed in HTML attributes. 3. Parse and validate repository URLs, allowing only HTTPS URLs on approved GitHub hosts. 4. Restrict `language` and `since` to documented allowlists. 5. Prefer a template engine with automatic escaping enabled by default. 6. Consider generating a plain-text alternative for every email. 7. Add tests with values containing quotes, angle brackets, HTML tags, event attributes, and malicious URL schemes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.js:51
• Finding: Unauthenticated Endpoints Permit Outbound Request and Storage Amplification<![CDATA[ ## Vulnerability Details **File Location**: `src/index.js:51-58` and `src/index.js:72-91` **Vulnerability Type**: Missing rate limiting and resource controls **Risk Level**: Medium ### Vulnerable Code ```js this.app.use(express.json()); this.app.use(express.urlencoded({ extended: true })); // CORS this.app.use((req, res, next) => { res.header('Access-Control-Allow-Origin', '*'); res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization'); next(); }); ``` ```js // Get trending repositories this.app.get('/trending', async (req, res) => { try { const { language = '', since = 'daily' } = req.query; const repos = await this.scraper.getTrending(language, since); res.json({ success: true, data: repos, count: repos.length, language: language || 'all', since }); } catch (error) { console.error('Trending endpoint error:', error); res.status(500).json({ error: error.message }); } }); ``` Subscription creation also performs an outbound payment-provider request and adds an entry to an unbounded in-memory map: ```js const paymentRequest = await this.payment.createPaymentRequest(userId); this.subscriptions.set(userId, { channels, preferences: { language: preferences.language || '', since: preferences.since || 'daily', schedule: preferences.schedule || process.env.SCHEDULE || '0 9 * * *' }, status: 'pending', paymentId: paymentRequest.paymentId, createdAt: new Date().toISOString() }); ``` ### Technical Analysis The application exposes request-amplifying endpoints without authentication, throttling, caching, quotas, or concurrency limits. Each `/trending` request produces an outbound GitHub page request and may produce a second GitHub API request when scraping fails or returns no repositories. Each `/subscribe` request calls the payment provider and can insert an attacker-selected key into the subscription map. Wildcar ...[truncated 1104 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authenticated access where public anonymous operation is not essential. 2. Apply per-IP, per-account, and global rate limits. 3. Cache trending results for a short, bounded period by normalized language and time range. 4. Restrict `language` and `since` to supported values and enforce input-length limits. 5. Configure explicit outbound connection and response timeouts. 6. Limit concurrent GitHub and SkillPay requests with a queue or semaphore. 7. Apply subscription quotas and move storage to a bounded, durable database. 8. Restrict CORS to approved origins if browser clients are required. 9. Add monitoring for request spikes, external API failures, memory growth, and quota consumption. ]]>

T08 · Insecure Dependencies

Note

• Location: package.json:23
• Finding: Unpinned Dependencies and Missing Lockfile Make Builds Non-Reproducible<![CDATA[ ## Vulnerability Details **File Location**: `package.json:23-33` **Vulnerability Type**: Mutable dependency resolution **Risk Level**: Low ### Vulnerable Code ```json "dependencies": { "axios": "^1.6.0", "cheerio": "^1.0.0-rc.12", "node-cron": "^3.0.3", "telegraf": "^4.15.0", "discord.js": "^14.14.0", "nodemailer": "^6.9.7", "dotenv": "^16.3.1", "express": "^4.18.2" }, "devDependencies": { "nodemon": "^3.0.2" } ``` No `package-lock.json`, `npm-shrinkwrap.json`, or equivalent dependency lockfile is present in the supplied project structure. The documentation directs users to execute `npm install`. ### Technical Analysis Caret version ranges permit npm to resolve newer compatible releases than those reviewed with the project. Without a committed lockfile, transitive dependency versions are also selected dynamically at installation time. No evidence was found that the named packages are typosquatted or intentionally malicious. The risk is that the effective dependency tree can change after the Skill audit, making installation non-reproducible and increasing exposure to compromised future releases or maintainer accounts. ### Attack Path 1. A direct or transitive dependency publishes a compromised release that satisfies a declared version range. 2. A user follows the documented `npm install` procedure. 3. npm resolves the newly published version because no reviewed lockfile constrains resolution. 4. The package's installation or runtime code executes with the privileges of the user running the Skill. ### Impact Assessment If a future dependency release is compromised, impact could include arbitrary code execution within the Node.js process, access to configured API credentials, outbound data disclosure, or modification of application behavior. This is a supply-chain hardening issue; the audit did not confirm an existing malicious dependency. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate and commit a reviewed `package-lock.json`. 2. Use `npm ci` in CI and deployment instead of unconstrained `npm install`. 3. Pin direct dependencies to specifically reviewed versions where operationally appropriate. 4. Run dependency vulnerability and provenance checks in CI. 5. Review lockfile changes as security-sensitive code changes. 6. Use automated dependency updates with testing and approval rather than automatic unreviewed resolution. 7. Consider disabling unnecessary installation scripts in controlled build environments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Credential Access

High

• Category: Privilege Escalation

Content

├── skill.json                # Clawhub configuration
├── SKILL.md                  # Skill documentation
├── README.md                 # Project README
├── .env                      # Environment variables
├── .gitignore                # Git ignore
└── test.js                   # Test script
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The README includes what appears to be a real SkillPay API key rather than a placeholder example. Publishing live credentials in documentation can allow unauthorized third parties to use the service, incur charges, access account data, or pivot into related systems if the key remains valid.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file describes Telegram, Discord, Email notifications and subscription management, and later shows a subscription example containing a userId and chatId, but it does not warn users that these identifiers and notification content may be transmitted to third-party services. For a markdown skill description, external data-sharing behavior that could affect privacy should be disclosed explicitly.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Fetch Trending Repos
```bash
curl "http://localhost:3000/trending?language=javascript&since=daily"
```

### Subscribe to Daily Reports

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The markdown documents POST /notify and POST /subscribe request bodies containing Telegram chat IDs and email addresses, and it describes scheduled outbound notifications. There is no user-facing warning about transmitting/storing these identifiers or about the privacy impact of sending data to Telegram, Discord, and email services.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The configuration section lists multiple sensitive credentials and connection settings without warning users to keep them secret, and in context it also includes an apparently real API key example. This increases the likelihood that users will paste real secrets into files, commit them to source control, or otherwise expose notification and email infrastructure credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file documents POST /notify and POST /subscribe requests that send userId plus notification-channel data such as Telegram chat IDs, but it does not warn users that their data will be transmitted to external messaging or email services. Because markdown files should disclose behaviors affecting privacy or user data, the omission is a meaningful safety gap.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill requires or supports sensitive credentials including an API key, bot token, webhook URL, and SMTP credentials, but the markdown provides no caution about storing, exposing, or protecting these secrets. For a skill description, this omits an important warning about privacy and system integrity implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  # Fetch trending JavaScript repos
  curl "http://localhost:3000/trending?language=javascript&since=daily"

  # Subscribe to daily reports
  curl -X POST http://localhost:3000/subscribe \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: This manifest describes the skill generically as providing "Daily monitoring of GitHub trending repositories with multi-channel notifications" but does not specify how or when it should be invoked, nor any limiting trigger phrases or exclusion conditions. In a manifest file, this kind of broad description can contribute to ambiguous activation behavior because the trigger scope is not clearly bounded.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code initializes a payment system and later creates payment requests, verifies payments, handles payment callbacks, and logs billable usage. With no manifest available and only code documentation identifying the app as a GitHub trending monitor, integrated payment processing is an additional business capability not inherently required to fetch or notify about trending repositories.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The GET /subscription/:userId endpoint returns the full stored subscription object for any supplied userId with no authentication or authorization checks. Because the object includes channel configuration and payment-related metadata, an attacker can enumerate or guess user IDs and retrieve other users' subscription details.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This endpoint exposes stored subscription data without any access control, allowing any caller to query another user's subscription status and associated delivery settings. In context, that can leak email targets, Telegram chat IDs, Discord usage, schedule preferences, and internal payment linkage information.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The scheduler automatically fetches trending data and sends notifications to Telegram, Discord, or email based on stored subscription settings. Although subscription creation mentions payment completion, this file does not provide any explicit user-facing warning or confirmation that ongoing automated outbound notifications will continue on a schedule.

External Transmission

Medium

• Category: Data Exfiltration

Content

class SkillPayment {
  constructor(apiKey) {
    this.apiKey = apiKey;
    this.baseURL = 'https://api.skillpay.me/v1';
    this.pricePerCall = 0.001; // USDT
  }

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The payment description sent to the processor identifies the charge as "GitHub Trending Monitor - API Call" while the module is documented as "SkillPay Payment Integration." Mislabeling payment purposes can mislead users, complicate dispute resolution, and indicate reused or mismatched billing logic that may result in deceptive or unauthorized-looking charges.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The logUsage function transmits userId, action, timestamp, and amount to a remote analytics endpoint without any visible consent, minimization, or disclosure controls in this code. This creates privacy and compliance risk because user activity data is exported to a third party and could be collected without the user's knowledge or a clear lawful basis.

External Transmission

Medium

• Category: Data Exfiltration

Content

headers['Authorization'] = `token ${this.githubToken}`;
      }

      const response = await axios.get('https://api.github.com/search/repositories', {
        params: { q: query, sort: 'stars', order: 'desc', per_page: 25 },
        headers
      });

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The phrase "Full English documentation" indicates an English-only documentation constraint, and the later section reiterates that all documentation is in English. This is a natural-language locale policy issue because the file presents a fixed language choice without user opt-in or a documented regional/compliance justification.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The statement "All documentation is in English" explicitly fixes the skill's documentation language and lists all materials as English-only. Because no alternative language option, opt-in, or justification is provided, this constitutes a natural-language language-policy concern under the audit criteria.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The phrase "Full English documentation" indicates the skill materials are fixed to English, and later text reinforces that all code comments and docs are in English. This can violate language or locale policy when no user choice, opt-in, or justification for the language restriction is provided.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The statement "All code in English - Comments, docs, everything!" is an explicit English-only language constraint in natural-language content. Because the file does not provide an opt-in choice or a documented justification, it matches the language-policy violation category.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: This plain-text file presents "Ready? Run: npm install && npm start" as a generic call to action without clarifying context, prerequisites, or when a user should avoid running it. In a start-here document, that broad imperative can encourage unintended execution because it does not specify environment, trust boundaries, or exclusions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "zhdryanchang",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "node-cron": "^3.0.3",
    "telegraf": "^4.15.0",

• Confidence: 94% confidence
• Finding: The manifest uses a caret range for axios, which allows automatic installation of newer minor/patch releases rather than a single audited version. This increases supply-chain risk and makes builds non-reproducible, especially for a network-facing package with a history of advisories.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: axios has a known advisory history, and because the manifest does not pin an exact version, it is not possible to verify from this file whether deployed installs are affected. In a skill that fetches external content, a vulnerable HTTP client could increase exposure to SSRF, request smuggling, or other network-centric issues depending on the specific resolved version.

Static analysis

No suspicious patterns detected.