40Medium
The skill poses significant security risks by enabling autonomous code modifications without human oversight and potentially exfiltrating sensitive environment variables and secrets from CI logs into external reports.
Skill Info
Namewinrey/claude-code-toolkit/finish-feature
Registrygithub
Version668aea21899d
PURLpkg:github/winrey/claude-code-toolkit@668aea21899d?skill=finish-feature
Stars3
Installs1
Source
Install
Assessments (2)
AI Agent Traps ↗High-autonomy decision delegationmediumautonomy abuseAML.T0034.002AML.T0053LLM06:2025LLM10:2025
The skill instructs the agent to make 'judgment calls' on code changes and conflict resolutions without human oversight when in 'full' automation mode, creating a risk of silent, incorrect code modifications.
90% confidenceline 155
automation=full → analyze pros/cons, make a judgment call, record reasoning in final report (dispatch verifier if needed, but do not pause for user input)
Potential for credential exposure in logslowdata exfiltrationAML.T0025AML.T0024LLM02:2025
The skill instructs the agent to fetch and analyze CI logs, which may contain sensitive environment variables, secrets, or tokens, and potentially include them in the 'Sensitive Decisions Report'.
70% confidence
1. Fetch logs: gh run view <run_id> --log-failed
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/winrey/claude-code-toolkit/finish-feature)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/winrey/claude-code-toolkit/finish-feature"><img src="https://mondoo.com/ai-agent-security/api/badge/github/winrey/claude-code-toolkit/finish-feature.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/winrey/claude-code-toolkit/finish-feature.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow