It found something worth reading before you install it.
Agent Config Directory Access (high, rule AS1)
skills/auto-review-loop-llm/SKILL.md:36
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Not confirmed by the AI check.
Agent Config Directory Access (high, rule AS1)
skills/auto-review-loop-minimax/SKILL.md:65
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Not confirmed by the AI check.
External Model or Provider Selection (high, rule EA5)
skills/auto-review-loop/SKILL.md:520
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Not confirmed by the AI check.
External Model or Provider Selection (high, rule EA5)
skills/auto-review-loop/SKILL.md:840
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Not confirmed by the AI check.
Tool Parameter Abuse (high, rule TM1)
skills/experiment-queue/scripts/queue_manager.py:106
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Not confirmed by the AI check.
External Script Fetching (high, rule SC2)
skills/paper-illustration/SKILL.md:360
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Not confirmed by the AI check.
External Script Fetching (high, rule SC2)
skills/paper-illustration/SKILL.md:423
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Not confirmed by the AI check.
Agent Config Directory Access (high, rule AS1)
skills/paper-writing/SKILL.md:827
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Not confirmed by the AI check.
SkillSpector’s own score is 100/100 from 734 findings; only the ones its AI check confirmed count here.