dym-cti-expert-api-keys-and-capabilities
Fail
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: CRITICAL
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external cybersecurity and CTI services including FOFA, Shodan, Censys, and URLScan. These are well-known, legitimate industry services used for threat intelligence. While one scanner flagged en.fofa.info, this is the official domain for a well-known search engine for network assets and is considered a safe reference in a professional CTI context.
- [CREDENTIALS_UNSAFE]: The skill mentions numerous API key environment variables (e.g., SHODAN_API_KEY, FOFA_KEY, CENSYS_API_ID). However, it correctly follows security best practices by instructing the user to copy an example file to a local
.envfile that is gitignored, rather than hardcoding any secrets within the skill itself. - [COMMAND_EXECUTION]: The skill suggests running local Python scripts (e.g.,
python3 scripts/backend/intel.py capabilities). These commands are intended to check the status of the user's own local environment and configured API keys, which is standard behavior for a development or analysis tool.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata