Skills/skills.sh/security-audit

security-audit@r1

CAUTION

Publisher claims: "Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher cloudflare · joined 2 days agoInstalls 46,471Last detonated 31 h ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsvalidate-findings.test.cjs:320 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsATTACK-CLASSES.md:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsATTACK-CLASSES.md:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsvalidate-findings.test.cjs:606 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsvalidate-coverage-ledger.test.cjs:495 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Unicode escape sequence detectedvalidate-findings.test.cjs:22 · Unicode escape sequence detected — may contain obfuscated payloads
AST07
MEDIUM
File type combined with upload actionRECONNAISSANCE.md:156 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionHUNTING.md:210 · File type combined with upload action — agent may exfiltrate local data files
AST07