nemo-evaluator
The skill contains hardcoded credentials, lacks defined tool constraints, uses unpinned dependencies, and provides insecure documentation that encourages credential exposure, posing significant risks to system integrity and security.
Skill Info
Install
npx skills add https://github.com/firecrawl/ai-research-skillsAssessments (3)
AI Agent Traps ↗Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.
api_key="nvapi-your-key-here"
The documentation encourages users to export API keys as environment variables and hardcode them into configuration files, increasing the risk of accidental credential leakage through logs or version control. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
export NGC_API_KEY=nvapi-your-key-here
The documentation explicitly instructs users to export sensitive API keys (NGC_API_KEY, HF_TOKEN) into the shell environment, which persists in shell history and environment variables accessible to other processes.
export NGC_API_KEY=nvapi-your-key-here
NER model detected organization in skill content (confidence: 0.52)
L*
NER model detected organization in skill content (confidence: 0.54)
N****
NER model detected organization in skill content (confidence: 0.57)
S********
NER model detected organization in skill content (confidence: 0.59)
D*****
NER model detected organization in skill content (confidence: 0.61)
E*********
NER model detected organization in skill content (confidence: 0.62)
M*******
NER model detected organization in skill content (confidence: 0.67)
M***
NER model detected organization in skill content (confidence: 0.69)
N******
NER model detected organization in skill content (confidence: 0.72)
S******
NER model detected organization in skill content (confidence: 0.75)
N*****
NER model detected organization in skill content (confidence: 0.81)
H********
NER model detected organization in skill content (confidence: 0.90)
O********
NER model detected organization in skill content (confidence: 0.97)
L*****
NER model detected organization in skill content (confidence: 0.57)
*
NER model detected organization in skill content (confidence: 0.79)
*
NER model detected organization in skill content (confidence: 0.81)
*
NER model detected organization in skill content (confidence: 1.00)
M**
Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.
Unpinned dependency installation — package installed without version pinning
pip install nemo-evaluator-launcher
SKILL.md links to "references/adapter-system.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/adapter-system.md](references/adapter-system.md)
SKILL.md links to "references/configuration.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/configuration.md](references/configuration.md)
SKILL.md links to "references/custom-benchmarks.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/custom-benchmarks.md](references/custom-benchmarks.md)
SKILL.md links to "references/execution-backends.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/execution-backends.md](references/execution-backends.md)
The SKILL.md 'name' field does not match the skill's parent directory name, which the Agent Skills spec requires. A mismatch can confuse skill resolution or mask the skill's real identity.
nemo-evaluator-sdk ≠ nemo-evaluator
Badge
[](https://mondoo.com/ai-agent-security/skills/github/firecrawl/ai-research-skills/nemo-evaluator)<a href="https://mondoo.com/ai-agent-security/skills/github/firecrawl/ai-research-skills/nemo-evaluator"><img src="https://mondoo.com/ai-agent-security/api/badge/github/firecrawl/ai-research-skills/nemo-evaluator.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/firecrawl/ai-research-skills/nemo-evaluator.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow