Loading listing…
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
Nothing new reaches your agent until a person has looked at it.
A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.
Scanned on every change, and again when our rules improve.
Every scan of this listing, newest first.
Every rescan is logged, even when nothing changed.
Passed
Safe to install in every agent it supports. Runs in your agent, as instructions.
We read the SKILL.md your agent loads, and the listing for 29ef01e. 6 checks, no findings.
Mentions files that hold private keys or cloud tokens. SKILL.md, line 34
…les (`.env`, `.env.*`), key and credential material (`.pem`, `.key`, `id_rsa`, service-account JSON, anything under `secrets/` or `credentials/`),…
Runs whatever a URL returns, with no chance to read it first. SKILL.md, line 92
…g, ask before installing anything, and prefer a package manager over `curl | sh`. If you draw the video in a browser, make every frame a pure functio…
A skill has no tools of its own. It’s instructions, plus any scripts in its folder, that your agent loads when a task needs them, so it can do whatever your agent is allowed to do. We scan the whole SKILL.md for instructions that hide what they do, reach for credentials, run downloaded code or send data out.