everything-claude-code
A comprehensive AI-assisted development plugin that provides code generation, analysis, and security scanning capabilities across multiple programming languages including TypeScript, Python, Go, Swift, and PHP.
69
/ 100 · Grade D
D = 60–69
“I need to accelerate full-stack development across multiple programming languages with AI-assisted code generation, analysis, and built-in security scanning capabilities.”
everything-claude-code earned Verified status with a trust score of 69/100 (Grade D). No adversarial findings — all attack patterns were handled gracefully. Supply chain contains 467 components with 11 known vulnerabilities. Security scan flagged 128 findings. Tier is Verified rather than Certified due to unmitigated findings above severity thresholds.
Trust Score Breakdown
Eight weighted signals composing the aggregate trust score
Scheme v2.0 · Weights provisional · Consumer confirmations and uptime use pipeline-derived baselines.
Findings
Security scan results, adversarial testing, and pipeline review
Security Scan — Cisco Skill Scanner
Finding details
The skill instructs users to install 'agent-eval' from an external GitHub repository (github.com/joaquinhuigomez/agent-eval) without providing security verification steps. This creates a supply chain risk where users may install potentially malicious code from an untrusted source. The instruction 'Install agent-eval from its repository after reviewing the source' places the security burden on users without providing specific verification guidance.
The skill manifest is missing several optional but recommended metadata fields including 'license', 'compatibility', and 'allowed-tools' in the YAML frontmatter. While these fields are optional per the agent skills specification, their absence makes it harder for users to understand the skill's requirements and restrictions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements.
The skill package is incomplete and potentially deceptive. It claims to provide 'patterns and architectures for autonomous Claude Code loops' but contains no instruction body in SKILL.md and references four Python files (any.py, simple.py, ordering.py, its.py) that are missing from the package. This creates a capability inflation scenario where the skill appears to offer functionality it cannot deliver.
The skill package is missing several optional but recommended metadata fields in the YAML frontmatter: license, compatibility, and allowed-tools. While these are not required, their absence makes it difficult to assess the skill's intended usage constraints and compatibility requirements.
The skill is missing several optional metadata fields in the YAML manifest including license, compatibility, and allowed-tools. While these are optional fields, their absence reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements.
The skill references 10 Python files with unusual naming patterns (40.py, claims.py, a.py, your.py, the.py, DAT.py, all.py, one.py, thousands.py, each.py) that are all missing from the package. These file names appear to form sentence fragments and could indicate obfuscated or malicious content delivery mechanisms.
The skill is missing optional metadata fields 'compatibility' and 'allowed-tools' which could help users understand the skill's requirements and limitations. While not required, these fields improve transparency and help prevent misuse.
The skill includes a blocking operation (wait_for_mission) that can tie up the agent for up to 600 seconds by default. While the documentation recommends polling instead, the blocking option could be used to cause denial of service.
The skill requires connection to an external Claude DevFleet MCP server (http://localhost:18801/mcp) but provides no validation or error handling for service availability. This creates a dependency on an external system that could be compromised or unavailable.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to assess the skill's intended scope and restrictions.
The skill description uses broad language ('orchestrate multi-agent coding tasks') that could lead to over-activation for tasks outside its intended scope. The skill is specifically designed for Claude DevFleet integration but the description doesn't clearly limit this scope.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to understand the skill's intended usage constraints and compatibility requirements.
The skill instructions reference three Python files (config.py, entry.py, recent.py) that are not present in the skill package. While these may be example filenames used for illustration purposes, missing referenced files could indicate incomplete skill packaging or potential supply chain issues.
The skill executes git clone with a hardcoded URL but also allows user-provided paths as fallback. If the user provides a malicious path containing shell metacharacters, it could lead to command injection when used in subsequent bash operations.
The skill performs extensive file system operations (Read, Write, Bash) and network operations (git clone) but does not declare any allowed-tools restrictions in the YAML manifest. While this field is optional, the skill's behavior suggests it should declare [Read, Write, Bash] for transparency.
The skill is missing optional metadata fields (license, compatibility) that would help users understand the skill's requirements and licensing terms.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and tool requirements.
The skill promotes continuous autonomous agent loops with potential for unbounded execution. The instructions explicitly mention 'loop churn without measurable progress', 'repeated retries with same root cause', and 'cost drift from unbounded escalation' as known failure modes, indicating awareness of resource exhaustion risks. The skill references 'unbounded.py' which could not be found, suggesting missing critical implementation details for safety controls.
The skill references 'unbounded.py' in its instructions but this file is not found in the package. This creates uncertainty about the actual implementation and safety controls for the autonomous loops described. The missing file could contain critical safety mechanisms or dangerous unbounded execution patterns.
The skill manifest is missing several optional but recommended fields including license, compatibility, and allowed-tools specifications. While not required, these fields help users understand the skill's requirements and restrictions.
The skill accesses Claude Code session transcripts which may contain sensitive information including code, credentials, API keys, or personal data. The transcript path is obtained from hook input and processed without validation or sanitization. While the current implementation only counts messages, the infrastructure exists to read full transcript content.
The skill creates and writes to directories in the user's home directory (~/.claude/skills/learned/) without explicit user consent. The YAML manifest does not declare 'Write' in allowed-tools, but the script performs file system modifications. This violates the principle of least privilege and could be used for persistence or data manipulation.
The skill manifest is missing several optional but recommended fields including 'license', 'compatibility', and 'allowed-tools'. The 'allowed-tools' field is particularly important as the skill performs file system operations that should be declared.
The script falls back to reading the CLAUDE_TRANSCRIPT_PATH environment variable, which could potentially be manipulated by other processes or contain unexpected paths. While this appears to be for backwards compatibility, it creates an additional attack surface.
Multiple scripts use environment variables and user-controlled input in shell commands without proper sanitization. The observer-loop.sh script constructs file paths and command arguments using variables that could contain shell metacharacters, leading to command injection vulnerabilities.
The observer-loop.sh script contains hardcoded credential patterns and executes automated Claude sessions with access to sensitive files. The script reads observations that may contain credentials, API keys, and other secrets, then passes this data to external Claude API calls without proper sanitization. While there is some regex-based scrubbing, the patterns are incomplete and the data is still transmitted to external services.
The observation hooks collect and store detailed information about user tool usage, including command inputs, outputs, and file paths. This data is stored in plaintext JSONL files and includes potentially sensitive information like file contents, command arguments, and system paths.
The observer system automatically grants itself Read and Write tool access without user consent and can modify the file system through instinct file creation. The system bypasses normal tool restrictions by running automated Claude sessions with elevated privileges.
Skill code uses network libraries but doesn't declare network requirement
The observer system can spawn multiple concurrent Claude analysis processes without proper resource limits. The observer-loop.sh script has some throttling mechanisms but still allows for potential resource exhaustion through rapid observation accumulation and parallel process spawning.
The skill description claims to be an 'advanced learning system' with broad capabilities including 'evolving instincts into skills/commands/agents' and 'automatic learning from Claude Code sessions'. The activation triggers are very broad and could lead to unwanted activation in many contexts.
The skill references three Python files (run.py, the.py, functions.py) in its instructions but these files are not found in the skill package. This creates a broken skill that cannot function as intended and may cause runtime errors when the agent attempts to execute the missing components.
The skill package is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. While not a security threat, this reduces transparency about the skill's intended usage and restrictions.
The skill has no markdown instruction body, making it unclear how the skill should be used or what functionality it provides. This could lead to unpredictable behavior when the agent attempts to use the skill.
The example code makes HTTP requests to external services without proper input validation or sanitization. The endpoint URL and request data are not validated, which could lead to injection attacks if user input is incorporated into the requests.
The skill references a hardcoded environment variable 'POSTBRIDGE_API_KEY' in example code that could expose API credentials. While this is in example code, it demonstrates a pattern that could lead to credential exposure if implemented without proper security practices.
Code block in SKILL.md at line 147 contains potentially dangerous Python code.
The skill manifest is missing optional fields like 'license', 'compatibility', and 'allowed-tools' which provide important context about the skill's intended usage and restrictions.
The skill references a file 'one.py' in its instructions but this file is not found in the skill package. This could indicate incomplete packaging or broken references.
The skill references 15 Python files (the.py, Incoterms.py, duties.py, entries.py, a.py, industrial.py, or.py, clearance.py, foreign.py, different.py, their.py, 8542.py, period.py, an.py, suppliers.py) that are completely missing from the package. This creates a broken skill that cannot function as intended and may indicate supply chain compromise, incomplete packaging, or dependency injection vulnerabilities. The skill claims extensive trade compliance expertise but lacks any implementation.
The skill makes extensive claims about trade compliance expertise ('15+ years experience', 'HS classification logic', 'Incoterms application', 'FTA utilization', 'penalty mitigation') but provides no actual implementation. The instruction body is completely empty, and all referenced implementation files are missing. This represents capability inflation where the skill overstates its abilities.
The skill is missing optional metadata fields including 'compatibility' and 'allowed-tools'. While these are not required, their absence makes it unclear what agent tools the skill expects to use and what environments it's compatible with.
The skill claims to be a 'fully automated AI-powered data collection agent' but contains no actual implementation code. The description promises extensive functionality including web scraping, LLM integration, database storage, and GitHub Actions automation, but the skill package is essentially empty with no SKILL.md instruction body and no script files. This represents capability inflation where the skill overstates its abilities to increase activation likelihood.
The skill references 22 external Python modules/files that are not found in the package, creating potential supply chain vulnerabilities. These missing dependencies could lead to runtime failures or create opportunities for dependency confusion attacks if malicious packages with similar names are installed.
The skill lacks important metadata including license, compatibility information, and allowed-tools specification. This makes it difficult to assess the skill's intended usage scope and security boundaries. The absence of proper provenance information reduces trust and makes security assessment more challenging.
The skill relies heavily on external web sources (firecrawl and exa MCPs) to fetch and process content from arbitrary URLs without explicit validation mechanisms. While this is the intended functionality for research, it creates potential for indirect prompt injection if malicious content is encountered in web sources.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and restrictions.
The skill uses very broad activation keywords that could lead to unintended activation. Keywords like 'research', 'investigate', 'what's the current state of' are extremely common and could trigger this skill for simple queries that don't require deep multi-source research.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. While not a security vulnerability, this reduces transparency about the skill's intended usage and tool requirements.
The skill instructs users to install dmux from an external GitHub repository (github.com/standardagents/dmux) after 'reviewing the package'. This creates a transitive trust relationship where malicious instructions could be embedded in the external repository's documentation, README, or installation scripts that could override the agent's intended behavior.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions.
Pattern detected: postgres://postgres:postgres@
The skill documentation contains example database connection strings with hardcoded credentials (postgres:postgres). While these appear to be example/development credentials in documentation, they could be copied by users into production environments, creating security risks.
The skill manifest is missing optional metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions.
The skill references four Python files (db.py, bind.py, local.py, host.py) in its instructions, but these files are not present in the skill package. This could lead to confusion or errors when users try to follow the instructions.
The skill sends user queries to an external MCP service (Context7) which could potentially log or store user questions. While the skill includes guidance to redact sensitive data, user queries may inadvertently contain sensitive information that gets transmitted to the external service.
The skill places implicit trust in documentation content returned by the Context7 MCP service without validation. Malicious or compromised documentation sources could potentially inject harmful instructions or misleading information that the agent would then relay to users.
The skill manifest is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. This reduces transparency about the skill's requirements and intended usage scope.
The skill references 8 Python files (prior.py, generation.py, the.py, your.py, shaped.py, a.py, qualified.py, physical.py) that are not found in the package. These appear to be incomplete or corrupted file references that could indicate a supply chain compromise, incomplete package distribution, or dependency issues. The unusual naming pattern (single words like 'the.py', 'a.py') suggests potential corruption or automated generation errors.
The skill manifest is missing optional fields 'compatibility' and 'allowed-tools' which provide important context about the skill's intended usage and tool restrictions. While these fields are optional per the agent skills specification, their absence makes it harder to validate appropriate usage and security boundaries.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage constraints and compatibility requirements.
The skill description uses broad, enterprise-level terminology ('operate long-lived agent workloads', 'observability', 'security boundaries') without clearly defining what specific actions the skill can perform. This could lead to unclear expectations about the skill's actual capabilities.
The skill manifest is missing optional fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and restrictions.
The skill references three files (video.py, text.py, an.py) in its instructions but these files are not present in the skill package. This could indicate incomplete packaging or potential confusion about skill structure.
The skill instructs users to install the fal-ai MCP server using 'npx -y fal-ai-mcp-server' without specifying a version. This could lead to supply chain risks if the package is updated with malicious code.
The skill references four Python files (style.py, maintainers.py, only.py, public.py) that are not found in the package. If these files are expected to be provided externally or by users, they could contain malicious instructions that override the skill's intended behavior. The skill appears to have no instruction body in SKILL.md, suggesting it may rely entirely on these missing external files for its functionality.
The skill is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. While not a security threat, this reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. While these fields are not required, their absence makes it harder to assess the skill's intended usage scope and compatibility requirements.
The skill references 14 Python script files (forecast.py, the.py, similar.py, Week.py, existing.py, 14.py, current.py, your.py, history.py, selling.py, first.py, dominating.py, an.py, vendors.py) but none of these files are present in the skill package. This creates a supply chain integrity issue where the skill cannot function as intended and may lead to runtime errors or unexpected behavior when the agent attempts to execute missing dependencies.
The skill claims to provide 'codified expertise for demand forecasting, safety stock optimization, replenishment planning' but lacks the actual implementation files. The instruction body is empty, and all referenced Python scripts are missing. This represents capability inflation where the skill advertises functionality it cannot deliver.
The skill manifest is missing optional fields 'compatibility' and 'allowed-tools' which provide important context for proper skill usage and security boundaries. While not critical, these fields help users and systems understand the skill's requirements and limitations.
The skill references a file 'the.py' that is not present in the package. This could indicate incomplete packaging, broken functionality, or potentially suspicious behavior where the skill expects external files.
The skill is missing optional metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions.
The skill instructions reference two Python files (encrypted.py and users.py) that are not present in the skill package. While this doesn't pose an immediate security threat, missing referenced files could lead to confusion or errors when users attempt to follow the instructions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and tool requirements.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to assess the skill's intended scope and restrictions.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to assess the skill's intended scope and restrictions.
The skill instructs users to export their Nutrient API key as an environment variable but lacks security guidance about protecting this credential. While the skill itself doesn't hardcode secrets, it could provide better guidance on secure credential management.
The skill references a file 'PDFs.py' in the instructions but this file is not present in the skill package. This could indicate incomplete packaging or missing dependencies.
The skill manifest is missing optional metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and restrictions.
The skill describes spawning Claude subprocesses with user-controlled data (violation JSON) and executing shell commands through hooks. The multi_linter.sh hook runs formatters and linters with potential command injection vectors through file paths and violation data.
The skill operates largely invisibly to the main agent, with most operations happening in background hooks that don't report their actions. This creates opacity around what code is being executed and modified.
The skill claims to provide 'write-time code quality enforcement' but actually implements a complex system that can block tools, modify files silently, and spawn subprocesses. The actual capabilities far exceed what's described in the simple description.
The skill implements a hook system that can block legitimate tool usage (PreToolUse hooks block package managers like pip, npm) and modify file operations without user awareness. This could interfere with normal agent tool functionality.
The skill claims extensive production scheduling expertise including 'TOC/drum-buffer-rope, SMED, OEE analysis, disruption response frameworks, and ERP/MES interaction patterns' and states it is 'informed by production schedulers with 15+ years experience.' However, the skill contains no actual implementation - no script files and no instruction body content. This represents capability inflation where the skill over-promises functionality it cannot deliver.
The skill is missing optional metadata fields including 'compatibility' and 'allowed-tools' specifications. While these are not required, their absence makes it unclear what environments the skill supports and what agent tools it intends to use, which could lead to unexpected behavior or compatibility issues.
The skill references 6 Python files (Approved.py, that.py, the.py, incoming.py, rework.py, adjacent.py) that are not found in the package. These missing files could indicate incomplete packaging, dependency issues, or potential supply chain compromise if the skill expects these files to be present for proper operation.
The skill is missing optional metadata fields 'compatibility' and 'allowed-tools' which could help users understand the skill's requirements and limitations. While not a security threat, this reduces transparency about the skill's intended usage patterns.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it difficult to assess the skill's intended scope and restrictions.
The skill instructions reference a file 'active.py' that is not found in the skill package. This could indicate incomplete packaging or a broken reference that might affect skill functionality.
The skill references 10 Python files (delivery.py, multiple.py, store.py, address.py, returns.py, same.py, expected.py, original.py, shipping.py, vendor.py) that are not found in the package. This creates a supply chain integrity issue where the skill cannot function as intended and may fail unexpectedly when users attempt to use it. The missing files could also indicate an incomplete or corrupted package distribution.
The skill claims extensive returns management capabilities ('codified expertise for returns authorization, receipt and inspection, disposition decisions, refund processing, fraud detection, and warranty claims management') but provides no actual implementation. The SKILL.md contains no instruction body, and all referenced Python files are missing. This represents capability inflation where the skill cannot deliver on its promised functionality.
The skill is missing optional metadata fields that would help users understand its capabilities and restrictions. The 'compatibility' and 'allowed-tools' fields are not specified, making it unclear what environments the skill supports or what agent tools it requires.
The bash scripts use user-controlled environment variables (RULES_DISTILL_DIR, RULES_DISTILL_GLOBAL_DIR, RULES_DISTILL_PROJECT_DIR) in file system operations without proper validation. While some basic path validation exists, an attacker could potentially manipulate these environment variables to access unintended directories or inject commands through path manipulation.
The skill reads and processes content from external skill files and rule files, then feeds this content to LLM subagents for analysis. Malicious skills could embed instructions that manipulate the analysis process, potentially causing the LLM to generate harmful rules or bypass safety measures during the cross-reading phase.
The skill performs file system operations (reading skills, rules, writing results) and executes bash scripts, but does not declare any allowed-tools in the manifest. This violates the principle of explicit tool permission declaration and could lead to unauthorized tool usage.
The scripts traverse and read files from user directories (~/.claude/skills, ~/.claude/rules) and project directories. While this appears to be the intended functionality, there's potential for information disclosure if the skill is used in environments where these directories contain sensitive information.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's requirements and constraints.
The skill has broad file system access capabilities that could be exploited for data exfiltration. The runner.py creates sandbox directories in /tmp and executes claude with --add-dir flag, potentially exposing sensitive files. The skill reads arbitrary user-specified files (skill_path argument) and processes their content through LLM calls, which could leak sensitive information through the model API calls.
The skill executes arbitrary shell commands through subprocess.run() with user-controlled input in multiple locations. In runner.py, scenario setup_commands are executed directly via shlex.split() and subprocess.run() without validation. In spec_generator.py and scenario_generator.py, the skill calls 'claude -p' with user-provided prompts that could contain shell metacharacters. This allows command injection if malicious content is embedded in skill files or generated scenarios.
The skill performs potentially resource-intensive operations without proper limits. It executes scenarios with configurable max_turns (default 30) and timeout (300s), but these could be set to excessive values. The skill also processes arbitrary file sizes and generates multiple LLM calls per execution, which could lead to compute exhaustion if used with large files or malicious inputs designed to consume resources.
The skill's YAML manifest is missing optional but important metadata fields including license and compatibility information. While not a direct security threat, this lack of provenance information makes it harder to assess the skill's trustworthiness and intended usage scope.
The skill's YAML manifest declares 'tools: Read, Bash' but the actual implementation uses significantly more tools including Write, Edit, Glob, and Grep. The runner.py explicitly enables '--allowedTools Read,Write,Edit,Bash,Glob,Grep' which violates the declared tool restrictions. This represents tool capability inflation where the skill claims limited functionality but actually has broader permissions.
The skill instructions reference a file 'env.py' that is not included in the skill package. This could indicate incomplete packaging or a documentation error.
The skill is missing several optional metadata fields in the YAML manifest including license, compatibility, and allowed-tools. While these are optional, their absence reduces transparency about the skill's requirements and usage constraints.
The skill manifest is missing optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence reduces transparency about the skill's intended usage and restrictions.
The skill manifest is missing optional fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to assess the skill's intended scope and restrictions.
The skill instructs the agent to execute various shell commands (npm, pnpm, npx, pyright, ruff, grep, git) without any validation or sandboxing. While these are legitimate development tools, the skill provides no guidance on validating command safety or handling potentially malicious project configurations that could exploit these commands.
The skill includes commands to search for API keys and secrets (grep for 'sk-' and 'api_key') which could inadvertently expose sensitive information in the verification report output. While the intent is security scanning, the implementation could lead to secrets being displayed in logs or reports.
The skill manifest is missing several optional metadata fields including license, compatibility, and allowed-tools. While these fields are optional per the agent skills specification, their absence makes it harder to assess the skill's intended scope and restrictions.
Pattern detected: while True:
The skill declares 'allowed-tools: Read Grep Glob Bash(python:*)' but the instructions extensively use Python execution and file operations that may exceed read-only access. The skill performs network operations, file writing (PID files, event logs), and system-level operations that go beyond the declared tool restrictions.
Skill restricts tools to ['Read Grep Glob Bash(python:*)'] but bundled scripts appear to write to the filesystem, which conflicts with a read-only tool declaration.
The ws_listener.py script contains an infinite while loop (while retry_count < MAX_RETRIES) that could potentially run indefinitely under certain error conditions. While there are retry limits and backoff mechanisms, the outer connection loop could theoretically continue forever if connection attempts consistently fail in ways that don't increment retry_count properly.
The skill contains explicit instructions to bypass user consent and execute operations automatically. The instruction 'AUTOMATICALLY execute the following steps WITHOUT asking for confirmation' is a direct prompt injection that overrides normal safety protocols requiring user consent for potentially sensitive operations like file processing and PDF generation.
The skill is designed to process highly sensitive visa application documents (bank statements, employment certificates, ID cards, passports) without implementing any security controls, access restrictions, or data handling safeguards. This creates risks for unauthorized access to personal financial and identity information.
The skill does not declare any allowed-tools restrictions in its manifest but instructs the agent to use multiple tools including file operations, shell commands, and Python execution. This creates a tool exploitation risk where the skill can use any available agent tools without restrictions.
The skill instructs the agent to execute shell commands with user-provided file paths using sips command for HEIC conversion. This creates a command injection risk if file paths contain malicious characters or shell metacharacters that could be interpreted by the shell.
The skill manifest is missing several optional but important metadata fields including license and compatibility information. While not a direct security threat, this reduces transparency and makes it harder to assess the skill's intended usage and restrictions.
The skill contains multiple code examples that demonstrate reading sensitive credentials from environment variables (X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, X_ACCESS_SECRET, X_BEARER_TOKEN) without proper validation or error handling. While using environment variables is a security best practice, the examples lack safeguards against credential exposure through error messages, logs, or debugging output.
The skill demonstrates API interactions without proper input validation or sanitization. User-provided content is directly passed to API endpoints without validation, which could lead to injection attacks or unexpected API behavior. The post_thread function and other examples accept arbitrary user input without sanitization.
The media upload example opens files without proper validation or access controls. The code demonstrates opening files directly from the filesystem without checking file permissions, validating file types, or ensuring the file path is safe. This could lead to unauthorized file access or path traversal attacks.
The skill manifest is missing several optional but recommended metadata fields including license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's requirements and limitations.
Adversarial Testing — 6 categories, 0 findings
No adversarial findings — all attack patterns handled gracefully.
Methodology v1.0 · 6 categories · ~55 attack patterns
Pipeline Review — 7 findings
cisco_skill_scanner: high finding — resource_abuse
cisco_skill_scanner: high finding — command_injection
cisco_skill_scanner: high finding — data_exfiltration
cisco_skill_scanner: high finding — supply_chain_attack
cisco_skill_scanner: high finding — skill_discovery_abuse
cisco_skill_scanner: high finding — hardcoded_secrets
cisco_skill_scanner: high finding — prompt_injection
Supply Chain
SBOM analysis and vulnerability assessment
Components
467
Direct deps
4
Transitive deps
463
Total vulns
11
Vulnerability breakdown
Format: CycloneDX 1.5 · Generated: Mar 28, 2026
Behavioral Fingerprint
Runtime performance baseline for drift detection
Samples
8
Error rate
0.0%
Peak memory
— MB
Avg CPU
—%
Response time distribution
Output size distribution
Fingerprint v1.0 · Baseline: Mar 28, 2026 · Status: baseline
Component Inventory
357 components composing this plugin
skills
126
agents
29
commands
63
hook
1
scripts
138
skills (126)
agents (29)
commands (63)
hooks (1)
scripts (138)
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use
Interface
Aggregated instruction summary
Scope & Permissions
What this capability can and cannot access — derived from pipeline analysis
yes
no
yes
yes
yes
no
Badge & Integration
Embed certification status in your README, docs, or CI pipeline
Certification Notes
Provenance observations from the pipeline
Publisher "Affaan Mustafa" is not verified — first certification from this publisher
Single contributor — no peer review evidence in commit history
Repository is 0 days old — recently created
Signed Artifact
Certification provenance and verification metadata
Pipeline Artifacts
Raw data files from this certification run — downloadable for independent verification
contract.json
Full unsigned contract
stage1-ingest.json
Ingest stage output
stage2a-sbom.json
SBOM generation results
stage2a-vulns.json
Vulnerability scan results
stage2b-security.json
Security scan results
stage3a-functional.json
Functional test results
stage3b-adversarial.json
Adversarial test results
stage3c-fingerprint.json
Behavioral fingerprint
stage4-certify.json
Certification decision + trust score
stage3a-measurements.json
Raw functional test measurements
stage3b-measurements.json
Raw adversarial test measurements
run-log.json
Pipeline execution log
Not all files may be present for every certification.