code-review-fix-hardened
Fail
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: A hardcoded API key (
sk_97337971993cff4076fb179c0e1f42d592a89406507c603db864d6784c849bd8) was found inlib/billing.ts. Storing secrets in source code is a major security risk that can lead to credential theft and unauthorized service access.\n- [EXTERNAL_DOWNLOADS]: The skill performs network operations usingfetchto interact withhttps://skillpay.mefor billing and account management. Furthermore, theSAFETY.mdfile contains a reference toPastbin.com, which is a blacklisted domain commonly used for malicious activity.\n- [COMMAND_EXECUTION]: The skill's main script (scripts/main.ts) reads and writes to the local filesystem, enabling it to modify user source code files. This capability, while central to the skill's purpose, requires high privileges and poses a risk of accidental or malicious code modification.\n- [DATA_EXFILTRATION]: The skill extracts the local machine's OS username usingrequire('os').userInfo().usernameand transmits it to the external SkillPay API as part of the user identification process, which constitutes a minor PII leak.
Recommendations
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata