registry / agentic-awesome-skills / 15.0.0

agentic-awesome-skills@15.0.0

⚠ Under review

AAS Core preview: local skill discovery, recommendation, stack validation, and planning, backed by 1,968+ agentic skills.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 50 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 206 file(s), 1.38 MB of source, external domains: amazon.com, api.apify.com, api.expo.dev, browserbase.com, console.apify.com, developers.notion.com, docs.anthropic.com, docs.stripe.com, fonts.googleapis.com, github.com, graph.facebook.com, huggingface.co, kit.svelte.dev, nextjs.org, platform.openai.com, prod.spline.design, registry.npmjs.org, turborepo.dev, vercel.com, web.dev, www.w3.org

Source & flagged code

41 flagged

skills/developer-signup-flow/SKILL.mdView file

Lines 145-185markdown

145

146**Good implementation (Stripe):**

1471. OAuth complete

1482. Dashboard shows test API keys immediately

1493. Keys are visible and copyable without extra clicks

1504. "Reveal" pattern for production keys, not test keys

151

152**Bad implementation:**

1531. OAuth complete

1542. "Welcome! Complete your profile to get started"

1553. Profile form required

1564. "Create your first project" wizard

1575. Project settings page

1586. "Generate API key" button

1597. Finally see a key

160

161### Key Display Best Practices

162

163```

164Your API Key

165sk_test_xxxxxxxxxxxxxxxxxxxx [Copy]

High

High Secret

Package contains a high-severity secret pattern.

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

166

167[Show in cURL example] [Show in SDK example]

168```

169

170- Show key in monospace font

171- Include one-click copy button

172- Show key in context (code example)

173- Test keys visible by default

174- Production keys behind "reveal" click

175- Never require downloading keys to a file

176

177### Multiple Keys and Key Management

178

179Wait until developers need this. First-time signup should show one key.

180

181Introduce key management when:

182- Developer creates a second project

183- Developer invites team members

184- Developer asks about key rotation

185

165patternName = stripe_test_secret severity = high line = 165 matchedText = sk[redacted]]

High

Secret Pattern

Stripe test secret key in skills/developer-signup-flow/SKILL.md

skills/developer-signup-flow/SKILL.mdView on unpkg · L165

tools/bin/install.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawnSync } = require("child_process");

4const path = require("path");

High

Child Process

Package source references child process execution.

tools/bin/aas.jsView file

Lines 1-9javascript

1#!/usr/bin/env node

2"use strict";

4const { main } = require("../lib/aas-v1/cli/main");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/bin/aas.jsView on unpkg · L3

6if (require.main ===

skills/huggingface-tool-builder/references/baseline_hf_api.tsxView file

Lines 19-58tsx

19 Uses HF_TOKEN for auth if the environment variable is set.

21Examples:

22 baseline_hf_api.tsx

23 baseline_hf_api.tsx 5

24 HF_TOKEN=your_token baseline_hf_api.tsx 10

25`);

skills/vercel-optimize/lib/vercel.mjsView file

Lines 1-35javascript

1// Vercel CLI helpers. All shell-outs use execFile (not exec) — no shell injection. Error detection: exit code + JSON-parse first; stderr grep only as fallback (CLI error strings aren't a stable contract).

3import { execFile } from 'node:child_process';

4import { promisify } from 'node:util';

5import { readFile, access } from 'node:fs/promises';

skills/gemini-deep-research/scripts/research.pyView file

•path = skills/gemini-deep-research/scripts/research.py kind = build_helper sizeBytes = 24204 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/gemini-deep-research/scripts/research.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/last30days/tests/test_dates.pyView file

•path = skills/last30days/tests/test_dates.py kind = payload_in_excluded_dir sizeBytes = 3684 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/last30days/tests/test_dates.pyView on unpkg

skills/competitor-analysis/scripts/gate_candidates.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = agentic-awesome-skills@14.6.0 matchedIdentity = npm:YWdlbnRpYy1hd2Vzb21lLXNraWxscw:14.6.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

skills/competitor-analysis/scripts/gate_candidates.mjsView on unpkg

skills/production-code-audit/SKILL.mdView file

Lines 132-172markdown

132- Purpose: E-commerce platform

133- Entry points: server.js, src/index.tsx

134

135**Phase 2: Scanning for Issues** (line-by-line analysis)

136

137Found 127 issues:

138- 🔴 CRITICAL: 8 issues

139- 🟠 HIGH: 23 issues

140- 🟡 MEDIUM: 41 issues

skills/screenshots/SKILL.mdView file

Lines 167-207markdown

1671. **Use `deviceScaleFactor: 2`** for true retina resolution

1682. **Set viewport to 1440x900** (produces 2880x1800 pixel images)

1693. **Handle authentication** if credentials were provided

1704. **Navigate to each page** and capture screenshots

171

172

skills/deployment-validation-config-validate/SKILL.mdView file

Lines 234-274markdown

234

235### 4. Configuration Testing

236

237```typescript

238import { describe, it, expect } from '@jest/globals';

239import { ConfigValidator } from './config-validator';

240

241describe

skills/fp-backend/SKILL.mdView file

1098patternName = generic_password severity = medium line = 1098 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/fp-backend/SKILL.md

skills/fp-backend/SKILL.mdView on unpkg · L1098

1213patternName = generic_password severity = medium line = 1213 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/fp-backend/SKILL.md

skills/fp-backend/SKILL.mdView on unpkg · L1213

skills/javascript-testing-patterns/resources/implementation-playbook.mdView file

516patternName = generic_password severity = medium line = 516 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/javascript-testing-patterns/resources/implementation-playbook.md

skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L516

536patternName = generic_password severity = medium line = 536 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/javascript-testing-patterns/resources/implementation-playbook.md

skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L536

551patternName = generic_password severity = medium line = 551 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in skills/javascript-testing-patterns/resources/implementation-playbook.md

skills/javascript-testing-patterns/resources/implementation-playbook.mdView on unpkg · L551

skills/fp-ts-errors/SKILL.mdView file

372patternName = generic_password severity = medium line = 372 matchedText = validate...5 })

Medium

Secret Pattern

Hardcoded password in skills/fp-ts-errors/SKILL.md

skills/fp-ts-errors/SKILL.mdView on unpkg · L372

373patternName = generic_password severity = medium line = 373 matchedText = // Right...5 })

Medium

Secret Pattern

Hardcoded password in skills/fp-ts-errors/SKILL.md

skills/fp-ts-errors/SKILL.mdView on unpkg · L373

skills/rclone-cli/references/providers/sftp.mdView file

157patternName = private_key_rsa severity = critical line = 157 matchedText = key_pem ...----

Critical

Secret Pattern

RSA private key in skills/rclone-cli/references/providers/sftp.md

skills/rclone-cli/references/providers/sftp.mdView on unpkg · L157

491patternName = private_key_rsa severity = critical line = 491 matchedText = key_pem ...----

Critical

Secret Pattern

RSA private key in skills/rclone-cli/references/providers/sftp.md

skills/rclone-cli/references/providers/sftp.mdView on unpkg · L491

skills/sql-injection-testing/SKILL.mdView file

215patternName = generic_password severity = medium line = 215 matchedText = SELECT *...mple

Medium

Secret Pattern

Hardcoded password in skills/sql-injection-testing/SKILL.md

skills/sql-injection-testing/SKILL.mdView on unpkg · L215

418patternName = generic_password severity = medium line = 418 matchedText = SELECT *...mple

Medium

Secret Pattern

Hardcoded password in skills/sql-injection-testing/SKILL.md

skills/sql-injection-testing/SKILL.mdView on unpkg · L418

skills/electron-development/SKILL.mdView file

541patternName = generic_password severity = medium line = 541 matchedText = read -rs...WORD

Medium

Secret Pattern

Hardcoded password in skills/electron-development/SKILL.md

skills/electron-development/SKILL.mdView on unpkg · L541

548patternName = generic_password severity = medium line = 548 matchedText = read -rs...WORD

Medium

Secret Pattern

Hardcoded password in skills/electron-development/SKILL.md

skills/electron-development/SKILL.mdView on unpkg · L548

skills/jest-skill/SKILL.mdView file

124patternName = generic_password severity = medium line = 124 matchedText = email: '...23',

Medium

Secret Pattern

Hardcoded password in skills/jest-skill/SKILL.md

skills/jest-skill/SKILL.mdView on unpkg · L124

skills/api-fuzzing-bug-bounty/SKILL.mdView file

213patternName = generic_password severity = medium line = 213 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in skills/api-fuzzing-bug-bounty/SKILL.md

skills/api-fuzzing-bug-bounty/SKILL.mdView on unpkg · L213

224patternName = generic_password severity = medium line = 224 matchedText = mutation...wt}}

Medium

Secret Pattern

Hardcoded password in skills/api-fuzzing-bug-bounty/SKILL.md

skills/api-fuzzing-bug-bounty/SKILL.mdView on unpkg · L224

225patternName = generic_password severity = medium line = 225 matchedText = mutation...wt}}

Medium

Secret Pattern

Hardcoded password in skills/api-fuzzing-bug-bounty/SKILL.md

skills/api-fuzzing-bug-bounty/SKILL.mdView on unpkg · L225

226patternName = generic_password severity = medium line = 226 matchedText = mutation...wt}}

Medium

Secret Pattern

Hardcoded password in skills/api-fuzzing-bug-bounty/SKILL.md

skills/k6-load-testing/SKILL.mdView file

176patternName = generic_password severity = medium line = 176 matchedText = JSON.str...' })

Medium

Secret Pattern

Hardcoded password in skills/k6-load-testing/SKILL.md

skills/k6-load-testing/SKILL.mdView on unpkg · L176

skills/api-documentation-generator/SKILL.mdView file

170patternName = generic_password severity = medium line = 170 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in skills/api-documentation-generator/SKILL.md

skills/api-documentation-generator/SKILL.mdView on unpkg · L170

Source & flagged code

41 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code