# Skills Directory

27 of 27 skills scanned for security vulnerabilities

## Skills Overview

- [**GitHub CLI**](/content/skills/github/index.html)  
  ✅85/100  
  Wrapper for GitHub CLI - delegates to official gh tool with secure OAuth.  
  Risk: low

- [**Weather**](/content/skills/weather/index.html)  
  ✅85/100  
  Wrapper for weather API - simple HTTP requests to public weather service.  
  Risk: low

- [**Weather API Skill**](/content/skills/weather-api-skill/index.html)  
  ✅85/100  
  Well-implemented security practices with proper input validation, rate limiting, and credential handling; minor concerns around API endpoint trust and error handling.  
  Risk: low

- [**1Password CLI**](/content/skills/1password/index.html)  
  ✅80/100  
  Wrapper for 1Password CLI - delegates security to the official 1Password command-line tool.  
  Risk: low

- [**OpenAI Whisper**](/content/skills/openai-whisper/index.html)  
  ✅80/100  
  Wrapper for local Whisper CLI - offline speech-to-text with no API calls.  
  Risk: low

- [**Apple Notes**](/content/skills/apple-notes/index.html)  
  ✅75/100  
  Wrapper for memo CLI - delegates to macOS Notes app via AppleScript.  
  Risk: medium

- [**Apple Reminders**](/content/skills/apple-reminders/index.html)  
  ✅75/100  
  Wrapper for remindctl CLI - delegates to macOS Reminders app via AppleScript.  
  Risk: medium

- [**Coding Agent**](/content/skills/coding-agent/index.html)  
  ✅75/100  
  Wrapper for AI coding assistants - delegates to external coding agents with full code access.  
  Risk: medium

- [**Google Places**](/content/skills/goplaces/index.html)  
  ✅75/100  
  Wrapper for Google Places API CLI - requires API key for location data access.  
  Risk: medium

- [**Local Places**](/content/skills/local-places/index.html)  
  ✅72/100  
  Google Places API integration with proper error handling but has path injection vulnerability and lacks input validation on critical parameters.  
  Risk: medium

- [**Skill Creator**](/content/skills/skill-creator/index.html)  
  ✅72/100  
  Template generation script with path traversal vulnerabilities and insufficient validation of user-controlled file operations.  
  Risk: medium

- [**OpenAI Image Gen**](/content/skills/openai-image-gen/index.html)  
  ✅72/100  
  Legitimate OpenAI image generation script with proper API usage, but has path traversal risks and writes files to user-controlled locations without sufficient validation.  
  Risk: medium

- [**Nano Banana Pro**](/content/skills/nano-banana-pro/index.html)  
  ✅72/100  
  Legitimate image generation tool with proper API key handling, but has path traversal vulnerabilities and unrestricted file system write access.  
  Risk: medium

- [**X/Twitter**](/content/skills/bird/index.html)  
  ✅70/100  
  Wrapper for bird CLI - cookie-based Twitter automation with potential session hijacking risks.  
  Risk: medium

- [**Google Workspace**](/content/skills/gog/index.html)  
  ✅70/100  
  Wrapper for Google Workspace CLI - requires OAuth tokens with broad API access.  
  Risk: medium

- [**MCP Tool Porter**](/content/skills/mcporter/index.html)  
  ✅70/100  
  Wrapper for Model Context Protocol tools - connects to external MCP servers.  
  Risk: medium

- [**Nano PDF**](/content/skills/nano-pdf/index.html)  
  ✅70/100  
  Wrapper for PDF editing CLI - processes PDF files with natural language.  
  Risk: medium

- [**Summarize**](/content/skills/summarize/index.html)  
  ✅70/100  
  Wrapper for video/audio summarization tools - downloads and transcribes media.  
  Risk: medium

- [**Discord**](/content/skills/discord/index.html)  
  ✅70/100  
  Wrapper for Discord bot - requires bot token with potential for token leakage.  
  Risk: medium

- [**Security Healthcheck**](/content/skills/healthcheck/index.html)  
  ⚠️65/100  
  Wrapper for security audit commands - executes system-level security checks.  
  Risk: medium

- [**Peekaboo**](/content/skills/peekaboo/index.html)  
  ⚠️65/100  
  Wrapper for macOS UI automation - requires accessibility permissions and screen recording.  
  Risk: medium

- [**WhatsApp CLI**](/content/skills/wacli/index.html)  
  ⚠️65/100  
  Wrapper for WhatsApp CLI - requires WhatsApp session with message access.  
  Risk: medium

- [**Model Usage**](/content/skills/model-usage/index.html)  
  ⚠️62/100  
  Script executes external commands and reads files with minimal input validation, presenting moderate security risks through command injection and path traversal vulnerabilities.  
  Risk: medium

- [**Video Frames**](/content/skills/video-frames/index.html)  
  ⚠️45/100  
  Script has command injection vulnerabilities through unsanitized user inputs passed to ffmpeg and mkdir commands, allowing arbitrary command execution.  
  Risk: high

- [**Android TikTok Automation**](/content/skills/android-tiktok-automation/index.html)  
  ⚠️45/100  
  Android automation library with significant command injection vulnerabilities and unrestricted device control capabilities that could be exploited for malicious purposes.  
  Risk: high

- [**API Integration Skill**](/content/skills/api-integration-skill/index.html)  
  🚨15/100  
  Critical security vulnerabilities including hardcoded credentials, SSRF, weak cryptography, injection vulnerabilities, and missing authentication controls.  
  Risk: critical

- [**File Reader Skill**](/content/skills/file-reader-skill/index.html)  
  🚨5/100  
  This skill contains multiple critical vulnerabilities including command injection, path traversal, and arbitrary code execution that could lead to complete system compromise.  
  Risk: critical