stacktree-status-dashboard
Fail
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to generate API keys at
https://app.stacktr.ee/api-keysand manage accounts athttps://stacktr.ee/x402. Automated scanners have flagged these specific URLs as malicious/phishing. - [COMMAND_EXECUTION]: The skill uses shell scripts (
bash scripts/publish.sh) to transmit data to external endpoints. While the scripts are local to the skill environment, they are used to pipe generated HTML content to a remote service. - [DATA_EXFILTRATION]: The skill is designed to publish system status, uptime, and incident reports to a public URL. While the instructions include a 'PII check' to block sensitive data, the core functionality involves sending system metadata and potentially sensitive infrastructure health data to an external service flagged for reputation issues.
- [CREDENTIALS_UNSAFE]: The skill requires a
STACKTREE_API_KEY(formatstk_live_...). While it correctly advises against hardcoding and asks the user to provide it via environment variables, the destination for these credentials (the stacktr.ee platform) is currently flagged as high-risk.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata