Skills

The skill insecurely executes unpinned npx packages and forces automatic installations via the -y flag, creating significant risks of supply chain attacks and unauthorized package deployment.

The skill lacks transparency due to the absence of code blocks or usage examples, preventing users from verifying its functionality and security posture.

No security issues detected in vercel-labs/agent-skills/vercel-react-best-practices.

This skill facilitates remote code execution via dynamic instruction fetching, exposes sensitive session data through an insecure proxy, and employs keyword stuffing to hijack agent control for unauthorized tasks.

The skill insecurely fetches and executes remote instructions, enabling unauthorized third parties to dynamically override the agent's behavior and bypass safety controls.

The skill uses keyword stuffing for over-triggering, lacks defined tool constraints for sensitive operations, and references missing documentation, suggesting potential runtime execution from unverified external sources.

The skill contains multiple broken documentation links to missing external files, creating an opaque execution environment that prevents proper security evaluation of its deployment workflows.

The skill lacks transparency due to missing code examples and licensing information, but it contains no malicious code or security vulnerabilities.

The skill lacks sufficient documentation and code examples, preventing users from verifying its functionality and assessing potential security risks.

The skill uses unpinned dependencies, hides content via CSS, performs unauthorized network and system operations, and relies on missing external documentation, creating significant security and supply chain risks.

The skill exhibits potential impersonation risks and relies on missing documentation files, causing silent workflow degradation and preventing transparent evaluation of its functionality.

The skill contains multiple broken documentation references, indicating incomplete packaging that may cause runtime failures or unexpected behavior when accessing external resources.

The skill lacks defined tool constraints and relies on missing external documentation, creating an opaque execution environment that prevents proper security auditing and verification of its runtime behavior.

The skill contains multiple broken documentation links, indicating poor maintenance and potential runtime instability due to missing dependency references.

The skill lacks transparency and relies on missing external documentation, creating an opaque execution environment that prevents proper security verification of its runtime behavior.

The skill lacks transparency and contains multiple broken documentation references, leading to potential runtime failures or reliance on unverified external content.

The skill lacks transparency and contains multiple broken documentation references, leading to silent runtime degradation and an inability for users to verify its intended functionality.

The skill lacks transparency and references multiple missing documentation files, creating an opaque execution environment where workflows may silently degrade or fetch external content from untrusted sources.

The skill lacks transparency and verifiable code documentation, preventing users from assessing its security posture or confirming it performs only intended Azure role-based access control operations.

The skill exhibits a potential supply chain risk by referencing external documentation that is missing from the package, which could lead to unauthorized content injection or runtime execution errors.

The skill impersonates a brand, lacks declared tool constraints, performs unauthorized network access, and relies on missing external documentation, creating significant security and transparency risks.

No security issues detected in microsoft/azure-skills/azure-kusto.

The skill contains broken documentation links and missing assets, leading to silent runtime degradation and a lack of transparency regarding its operational dependencies.

The skill contains broken documentation links to missing reference files, causing silent workflow degradation and preventing users from verifying security and configuration practices.

The skill forces the agent to bypass verified security best practices and relies on missing, externally sourced workflow files, creating significant risks of instruction override and unauthorized code execution.

The skill lacks transparency and relies on multiple missing documentation files, creating an opaque execution environment where critical workflow logic is sourced from external, unverified locations at runtime.

The skill enables arbitrary remote code execution by sending user-provided TSX to an external service and uses unpinned npx commands, creating significant risks for code injection and supply-chain attacks.

The skill executes unpinned npx packages at runtime, creating a critical supply chain vulnerability that allows for the potential execution of malicious or compromised code.

The skill executes unpinned and unverified npx packages at runtime, creating a significant supply chain risk by allowing arbitrary, potentially malicious code to run without integrity checks.

The skill impersonates a known brand and executes unpinned npx packages at runtime, creating a significant supply chain risk by allowing arbitrary code execution from the latest npm versions.

The skill executes unpinned packages at runtime and routes sensitive authentication credentials through an untrusted third-party platform, creating significant risks of supply chain compromise and credential exfiltration.

The skill executes unpinned, unverified dependencies and lacks tool constraints, while its image processing functionality introduces risks of indirect prompt injection via adversarial visual payloads.

The skill lacks defined tool constraints and mandates opaque, unverified external dependencies, creating an insecure execution chain that prevents proper security auditing and risk assessment.

The skill insecurely invokes an external dependency without verifying its origin or permissions, creating a significant risk of supply chain attacks and unauthorized privilege escalation.

The skill lacks defined tool constraints, executes unpinned dependencies, and processes external image URLs, creating significant risks of remote code execution and indirect prompt injection.

The skill executes unpinned and unverified packages via npx, creating a critical supply chain vulnerability that allows for the arbitrary execution of malicious or compromised code at runtime.

The skill lacks essential documentation files and a specified license, leading to potential runtime errors and ambiguity regarding usage terms.

The skill lacks defined tool constraints, executes unpinned and unverified dependencies, and processes external media, creating significant risks for arbitrary code execution and indirect prompt injection attacks.

The skill executes unpinned, unverified remote packages and performs unrestricted system operations while exposing users to potential adversarial prompt injection through external image processing.

The skill risks supply chain compromise through unpinned npx execution and exposes the agent to indirect prompt injection by processing unverified image content from external URLs.

The skill executes unverified, unpinned packages via npx, creating a critical supply chain vulnerability that allows for the arbitrary execution of malicious code from the npm registry.

The skill poses a significant security risk by exfiltrating arbitrary local files to a third-party service and executing unverified dependencies, potentially compromising user credentials and system integrity.

The skill forces the execution of an unverified external command that could inject malicious configurations or hooks into the agent's environment, posing a significant security risk.

The skill contains multiple broken documentation references that cause silent workflow degradation and fails to specify a required license, indicating poor maintenance and lack of transparency.

The skill executes unverified global dependencies and relies on external, non-packaged configuration files, creating a centralized security risk through insecure, unpinned, and opaque authentication and workflow logic.

The skill lacks defined tool constraints, allowing unrestricted execution of commands, file operations, and network access, which poses a significant security risk for unauthorized system interaction.

The skill introduces supply chain risks by fetching unpinned external assets and insecurely piping API responses directly into local files, enabling potential arbitrary code injection.

The skill documentation references multiple missing local files, causing potential runtime instability, and fails to specify a required license for usage.