Skills Directory

27 of 27 skills scanned for security vulnerabilities

Skills Overview

• GitHub CLI
  ✅85/100
  Wrapper for GitHub CLI - delegates to official gh tool with secure OAuth.
  Risk: low

• Weather
  ✅85/100
  Wrapper for weather API - simple HTTP requests to public weather service.
  Risk: low

• Weather API Skill
  ✅85/100
  Well-implemented security practices with proper input validation, rate limiting, and credential handling; minor concerns around API endpoint trust and error handling.
  Risk: low

• 1Password CLI
  ✅80/100
  Wrapper for 1Password CLI - delegates security to the official 1Password command-line tool.
  Risk: low

• OpenAI Whisper
  ✅80/100
  Wrapper for local Whisper CLI - offline speech-to-text with no API calls.
  Risk: low

• Apple Notes
  ✅75/100
  Wrapper for memo CLI - delegates to macOS Notes app via AppleScript.
  Risk: medium

• Apple Reminders
  ✅75/100
  Wrapper for remindctl CLI - delegates to macOS Reminders app via AppleScript.
  Risk: medium

• Coding Agent
  ✅75/100
  Wrapper for AI coding assistants - delegates to external coding agents with full code access.
  Risk: medium

• Google Places
  ✅75/100
  Wrapper for Google Places API CLI - requires API key for location data access.
  Risk: medium

• Local Places
  ✅72/100
  Google Places API integration with proper error handling but has path injection vulnerability and lacks input validation on critical parameters.
  Risk: medium

• Skill Creator
  ✅72/100
  Template generation script with path traversal vulnerabilities and insufficient validation of user-controlled file operations.
  Risk: medium

• OpenAI Image Gen
  ✅72/100
  Legitimate OpenAI image generation script with proper API usage, but has path traversal risks and writes files to user-controlled locations without sufficient validation.
  Risk: medium

• Nano Banana Pro
  ✅72/100
  Legitimate image generation tool with proper API key handling, but has path traversal vulnerabilities and unrestricted file system write access.
  Risk: medium

• X/Twitter
  ✅70/100
  Wrapper for bird CLI - cookie-based Twitter automation with potential session hijacking risks.
  Risk: medium

• Google Workspace
  ✅70/100
  Wrapper for Google Workspace CLI - requires OAuth tokens with broad API access.
  Risk: medium

• MCP Tool Porter
  ✅70/100
  Wrapper for Model Context Protocol tools - connects to external MCP servers.
  Risk: medium

• Nano PDF
  ✅70/100
  Wrapper for PDF editing CLI - processes PDF files with natural language.
  Risk: medium

• Summarize
  ✅70/100
  Wrapper for video/audio summarization tools - downloads and transcribes media.
  Risk: medium

• Discord
  ✅70/100
  Wrapper for Discord bot - requires bot token with potential for token leakage.
  Risk: medium

• Security Healthcheck
  ⚠️65/100
  Wrapper for security audit commands - executes system-level security checks.
  Risk: medium

• Peekaboo
  ⚠️65/100
  Wrapper for macOS UI automation - requires accessibility permissions and screen recording.
  Risk: medium

• WhatsApp CLI
  ⚠️65/100
  Wrapper for WhatsApp CLI - requires WhatsApp session with message access.
  Risk: medium

• Model Usage
  ⚠️62/100
  Script executes external commands and reads files with minimal input validation, presenting moderate security risks through command injection and path traversal vulnerabilities.
  Risk: medium

• Video Frames
  ⚠️45/100
  Script has command injection vulnerabilities through unsanitized user inputs passed to ffmpeg and mkdir commands, allowing arbitrary command execution.
  Risk: high

• Android TikTok Automation
  ⚠️45/100
  Android automation library with significant command injection vulnerabilities and unrestricted device control capabilities that could be exploited for malicious purposes.
  Risk: high

• API Integration Skill
  🚨15/100
  Critical security vulnerabilities including hardcoded credentials, SSRF, weak cryptography, injection vulnerabilities, and missing authentication controls.
  Risk: critical

• File Reader Skill
  🚨5/100
  This skill contains multiple critical vulnerabilities including command injection, path traversal, and arbitrary code execution that could lead to complete system compromise.
  Risk: critical