skill-maintenance

This is a readable skill-validation module with no evident embedded malware or network exfiltration. Its material security risk is that, by default, it executes target-provided scripts/*.mjs with the validator's operating-system privileges; the temporary working directory and timeout do not sandbox their access to files, environment variables, or network. Treat validation of untrusted skills as code execution and disable runScripts or use an external sandbox. Severity is moderate when runScripts is enabled, and low when it is disabled.

This is intended as a skill repository validation CLI, with no evident credential theft, network exfiltration, or destructive behavior in the shown code. Its significant security risk is executing each checked skill’s scripts/*.mjs via spawnSync, which can run attacker-controlled code with the caller’s privileges when checking an untrusted repository. The fragment also appears syntactically invalid as supplied. Severity: high when used on untrusted skill content; no suspicious domains, URLs, IPs, or targeted credentials are present.