Its AI check confirmed something serious. Don’t install it without reading what it found.
Not confirmed by the AI check: .agents/skills/changelog-video, .claude/skills/changelog-video, registry/blocks/frost-sequence-camera-orbit, registry/blocks/glass-shard-title, skills/embedded-captions and 1 more.
MCP Tool Poisoning (high, rule TP4)
registry/blocks/orbit-card/SKILL.md:1
The description says the skill is a single orbiting-dot-sphere feature card with Blender camera motion, but the code chunk is a general-purpose three.js library bundle. Nothing in this chunk implements the declared animation, and the chunk's network and audio capabilities are not reflected in the description. This may be a supporting asset of a larger skill (the library could be what the card renders with), so the mismatch is judged on this chunk alone. Confidence is high that the chunk does not
Not confirmed by the AI check.
Credential Access (high, rule PE3)
skills/hyperframes-cli/references/lambda.md:35
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Not confirmed by the AI check.
MCP Tool Poisoning (high, rule TP4)
registry/blocks/cuboid-carousel/SKILL.md:1
The skill tells the agent to run `npx --yes hyperframes@0.8.12`. The --yes flag skips the install confirmation, so a third-party npm package is downloaded and executed without the user noticing. The version is pinned, which limits the risk, but the capability is not declared and a registry compromise would still execute code.
Finding (medium, rule SDI-4)
skills/hyperframes-animation/scripts/package-loader.mjs:3
The header says specs are never floating 'latest', but hyperframesPackageSpec() falls back to pkg@latest for global installs, and assertPinnedPackageSpecs() accepts that because hasVersionSpec() only checks for an '@' character. A bootstrap install can therefore pull whatever version is newest at install time, and the module is then loaded with import(), which runs its top-level code even though --ignore-scripts blocks lifecycle hooks. The y/N prompt shows the @latest spec, which limits the risk
Finding (medium, rule SDI-4)
skills/hyperframes-creative/scripts/package-loader.mjs:3
The header promises that specs are never floating 'latest', but hyperframesPackageSpec() returns '<pkg>@latest' when the bundled version cannot be read (global installs). hasVersionSpec() treats any string containing '@' as pinned, so '@latest' passes assertPinnedPackageSpecs(). The bootstrap can then install whatever version is newest on npm. Because the loader dynamically imports the installed package, that unvetted code runs in the host process. --ignore-scripts does not stop this, since it o
Finding (medium, rule SQP-2)
skills/hyperframes-creative/references/design-picker.md:120
The instruction runs `python3 -m http.server 8723` from the project root. That server binds to all network interfaces by default and serves the entire working directory, not just the picker file, so anyone on the same LAN or network can read project files such as .env files, credentials, git config, or source for as long as the server runs. The server is also started in the background and is only killed after the user pastes the design, so the exposure window can be long.
MCP Rug Pull (medium, rule RP1)
.agents/skills/motion-doctrine/scripts/seam-gate.mjs:96
When the repo-local CLI is missing, line 96 runs 'npx --yes hyperframes preview', which pulls whatever the latest published hyperframes package is, unpinned, and auto-accepts the install with --yes. A compromised or typosquatted release would run code on the user's machine. The intent appears legitimate and the exposure is limited to the fallback path outside the repo, so this is a supply-chain hygiene weakness rather than malicious code.
MCP Least Privilege (medium, rule LP3)
registry/blocks/cuboid-carousel/SKILL.md:1
The skill declares no permissions or allowed-tools, yet its instructions cause network access (npm registry fetches via npx). Because nothing is declared, a user or host agent cannot tell what the skill is allowed to do before running it. The practical risk is low for this asset-only skill, but the gap hides the network and process-execution behaviour that users would otherwise review.
SkillSpector’s own score is 100/100 from 1865 findings, from its quick check alone.
