Its AI check confirmed something serious. Don’t install it without reading what it found.
Not confirmed by the AI check: ruflo, plugin files.
Finding (critical, rule SDI-2)
.agents/skills/github-code-review/SKILL.md:407
The webhook handler builds a shell command from raw PR comment text, so an attacker who can comment can run arbitrary commands on the host.
MCP Tool Poisoning (high, rule TP4)
.agents/skills/agent-agent/SKILL.md:1
Revised plans are implemented automatically after monitoring with no human review and no declared permissions. A bad revision could repeat or amplify errors without anyone noticing.
MCP Tool Poisoning (high, rule TP4)
.agents/skills/agent-release-manager/SKILL.md:1
The description calls this generic release coordination, but the skill pushes commits and opens PRs against a hardcoded third-party repository (ruvnet/ruv-FANN). A user who installs it for local release prep could write to a remote repo they do not own without that being disclosed.
Self-Modification (high, rule RA1)
.agents/skills/agent-safla-neural/SKILL.md:24
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Not confirmed by the AI check.
MCP Tool Poisoning (high, rule TP4)
.agents/skills/agent-swarm-pr/SKILL.md:1
The merge-decision example hardcodes ready_to_merge, validation_passed, agent_consensus 'approved', and a score of 9.2 regardless of review results. It also writes shared memory keyed by PR number with no declared permission. Consumers may trust fabricated approvals.
MCP Tool Poisoning (high, rule TP4)
.agents/skills/agent-workflow-automation/SKILL.md:1
Scheduled and push-to-main triggers run deployment and rollback agents without a human step. The description and triggers list do not disclose this unattended production action.
MCP Tool Poisoning (high, rule TP4)
.agents/skills/agentic-jujutsu/SKILL.md:1
The description presents the skill as version control only, but the examples run AI-recommended operations via executeOperation and push to remote branches. Users who trust the description will not expect a learned suggestion store to drive deployments or remote pushes, so the actual capability surface is hidden from them.
Finding (high, rule SQP-2)
.agents/skills/github-code-review/SKILL.md:402
The example runs commands from PR comment text with no injection warning, which invites copying an unsafe pattern.
SkillSpector’s own score is 100/100 from 12011 findings, from its quick check alone.
