run-llms

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

• high Tool Misuse · line 118
  Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
  Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
• high Supply Chain · line 134
  Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
  Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
• high Tool Misuse · line 134
  Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
  Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
• high Tool Misuse · line 239
  Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
  Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
• high Tool Misuse · line 483
  Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
  Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
• high Tool Misuse · line 876
  Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
  Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
• high Privilege Escalation · line 1217
  Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
  Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
• high Memory Poisoning · line 1228
  Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
  Fix: Protect agent memory and state from modification by untrusted content. Use read-only memory for critical instructions and validate all state changes.
• medium MCP Rug Pull · line 40
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium MCP Rug Pull · line 981
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium Privilege Escalation · line 47
  Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
  Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
• medium Privilege Escalation · line 118
  Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
  Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
• medium Privilege Escalation · line 123
  Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
  Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
• medium Data Exfiltration · line 483
  Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
  Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
• medium MCP Rug Pull · line 639
  Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
  Fix: Pin the image: image:tag or image@sha256:abc123
• medium Memory Poisoning · line 743
  Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
  Fix: Do not allow untrusted input to persist in agent memory or context. Validate all content before storing and implement memory isolation between sessions.
• medium Privilege Escalation · line 989
  Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
  Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.