registry / ani-skills / 2.1.0

ani-skills@2.1.0

ANI-Skills Ultra is a comprehensive AI Agent Skills library with 3,048+ skills across 29 semantic namespaces for Antigravity, Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini CLI, and OpenCode, featuring an interactive GUI installer.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package invokes an automatic installer that populates project and user-global skill directories for every detected AI agent. It can replace existing skill directories with a symlink to the package's skill collection.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

It changes multiple foreign AI-agent control surfaces without an explicit user command or agent selection.

Mechanism

Automatic broad AI-agent skill installation and directory replacement

Policy narrative

npm runs bin/install.js with --auto during postinstall. The installer enumerates installed AI agents and, for each detected one, installs all skills to both the current project's agent directory and the user's global agent directory. Where linking is enabled, it force-removes an existing target skill directory and replaces it with a symlink to this package. This is an unconsented, broad mutation of third-party AI-agent control surfaces.

Rationale

The automatic postinstall path broadly modifies foreign project and user-global AI-agent skill directories, including destructive replacement of existing directories. This meets the install-control-surface blocking policy.

Evidence

package.jsonbin/install.js.claude/skills.cursor/skills.windsurf/skills.github/skills.agents/skills.gemini/skills.opencode/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

The package automatically runs its installer after npm installation.
The installer detects several unrelated AI-agent installations and targets both consumer-project and user-global skill directories.
Automatic mode installs the complete skill set for every detected agent without user selection.
The installer can recursively delete existing agent skill directories before replacing them with a symlink.

Evidence against

No runtime dependency on another ani-skills release is declared.
The inspected installer contains no external network request or credential exfiltration path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 806 file(s), 5.93 MB of source, external domains: 127.0.0.1, abs.twimg.com, accounts.google.com, agent-media.ai, antigravity.google, api.browserbase.com, api.dicebear.com, api.example.com, api.maptiler.com, api.minimax.io, api.minimaxi.com, api.openai.com, api.postiz.com, api.replicate.com, api.stripe.com, api.telegram.org, api.typefully.com, api.weixin.qq.com, api.z.ai, app.taisly.com, ark.cn-beijing.volces.com, browserbase.com, card.weibo.com, cdn.example.com, cdn.jsdelivr.net, cdn.syndication.twimg.com, cdn.tailwindcss.com, cesium.com, challenges.cloudflare.com, cli-auth.postiz.com, cloud.maptiler.com, consent.youtube.com, console.anthropic.com, console.volcengine.com, content-push.googleapis.com, crates.io, cursor.com, dashscope.aliyuncs.com, defuddle.md, developers.cloudflare.com, developers.google.com, developers.openai.com, docs.anthropic.com, docs.github.com, docs.windsurf.com, docs.z.ai, example.com, example.io, example.openai.azure.com, example.org

Source & flagged code

27 flagged

package.jsonView file

Lines 1-32json

2 "name": "ani-skills",

3 "version": "2.1.0",

4 "description": "ANI-Skills Ultra is a comprehensive AI Agent Skills library with 3,048+ skills across 29 semantic namespaces for Antigravity, Claude Code, Cursor, Windsurf, Copilot, Codex, Gemini CLI, and OpenCode, featuring an interactive GUI installer.",

5 "main": "skills_index.json",

6 "bin": {

7 "ani-skills": "./bin/install.js"

8 },

9 "scripts": {

10 "build:index": "python scripts/update_skills_index.py",

11 "lint:skills": "python scripts/verify_stats.py",

12 "postinstall": "node bin/install.js --auto"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L12

13 },

14 "keywords": [

15 "skills",

16 "agent",

17 "antigravity",

18 "claude-code",

19 "workflows",

20 "gsap",

21 "scrolltrigger",

22 "marketing",

23 "seo",

24 "security",

25 "cursor",

26 "cursorrules",

27 "windsurfrules",

28 "ai-agents",

29 "agent-skills",

30 "developer-prompts",

31 "automation",

32 "threejs",

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView file

Lines 2-42markdown

3Detailed vulnerability patterns, exploitation techniques, and audit checklists for Firebase implementations in mobile applications.

5---

7## 1. OPEN EMAIL/PASSWORD SIGNUP (Critical)

9**The Problem:** Firebase Authentication allows anyone to create accounts via the Identity Toolkit API, even if the app UI doesn't expose registration.

11**Vulnerable Configuration:**

12```

bin/install.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * ANI-Skills Ultra Package Installer v2.0

4 * ========================================

5 * High-performance, multi-agent installer featuring:

6 * - Interactive Monochromatic Web GUI Popup with category checkboxes

7 * - Interactive TUI Terminal fallback

8 * - Full support for all 8 AI Coding Agents (Project & Global paths)

9 * - 3,028 Skills across 29 Semantic Namespaces

10 */

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView file

Lines 109-149typescript

109 return true;

110 }

111 if (i < retries - 1) {

112 console.error(`[paste] Attempt ${i +

skills/skills-webmcp-gen/scripts/compile.mjsView file

Lines 137-177javascript

137 success: true,

138 registeredTools: WEBMCP_GEN_TOOLS.map((tool) => tool.name),

139 };

140 }

141

142 window.__webmcpGenRegistration =

skills/skills-browser-to-api/scripts/infer.mjsView file

Lines 78-118javascript

78 responseSchemas[String(status)] = toSchema(p);

79 }

81 // Determine the canonical content-type per role from sample headers.

82 const reqCT = inferContentType(samples, 'reqHeaders');

skills/gstack-browse/src/cookie-import-browser.tsView file

196if (fs.existsSync(prefsPath)) { L197: const prefs = JSON.parse(fs.readFileSync(prefsPath, 'utf-8')); L198: const email = prefs?.account_info?.[0]?.email; ... L319: function getHostPlatform(): BrowserPlatform | null { L320: const p = process.platform; L321: if (p === 'darwin' || p === 'linux' || p === 'win32') return p as BrowserPlatform; ... L341: function getBaseDir(platform: BrowserPlatform): string { L342: if (platform === 'darwin') return path.join(os.homedir(), 'Library', 'Application Support'); L343: if (platform === 'win32') return path.join(os.homedir(), 'AppData', 'Local'); ... L527: L528: const proc = Bun.spawn(['powershell', '-NoProfile', '-Command', script], { L529: windowsHide: true,

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

skills/gstack-browse/src/cookie-import-browser.tsView on unpkg · L196

skills/gstack-browse/src/cli.tsView file

8* 4. Send command via HTTP POST L9: * 5. Print response to stdout (or stderr for errors) L10: */ ... L13: import * as path from 'path'; L14: import { spawn as nodeSpawn } from 'child_process'; L15: import { safeUnlink, safeUnlinkQuiet, safeKill, isProcessAlive } from './error-handling'; ... L25: const config = resolveConfig(); L26: const IS_WINDOWS = process.platform === 'win32'; L27: ... L40: */ L41: export function resolveStartTimeout(env: NodeJS.ProcessEnv = process.env): number { L42: // Cold Chromium launch measured ~5.7s at load avg 10 on a dev machine running

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

skills/gstack-browse/src/cli.tsView on unpkg · L8

skills/postiz-agent-postiz/src/commands/auth.tsView file

5L6: const CREDENTIALS_DIR = join(homedir(), '.postiz'); L7: const CREDENTIALS_FILE = join(CREDENTIALS_DIR, 'credentials.json'); L8: L9: const DEFAULT_AUTH_SERVER = 'https://cli-auth.postiz.com'; L10: ... L19: if (!existsSync(CREDENTIALS_FILE)) return null; L20: const data = JSON.parse(readFileSync(CREDENTIALS_FILE, 'utf-8')); L21: if (!data.accessToken) return null; ... L43: function openBrowser(url: string): void { L44: const { exec } = require('child_process'); L45: const platform = process.platform;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

skills/postiz-agent-postiz/src/commands/auth.tsView on unpkg · L5

skills/humanizer-ru/demo/markers.jsView file

206contains invisible/control Unicode U+202A (left-to-right embedding) "source": "[<U+200B><U+200C><U+200E><U+200F><U+202A>-<U+202E><U+2060>-⁤<U+2066>-<U+2069><U+FEFF>￹-￻]|(?<![🀀-🫿☀-➿️🇦-🇿])<U+200D>(?![🀀-🫿☀-➿️🇦-🇿])",

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

skills/humanizer-ru/demo/markers.jsView on unpkg · L206

skills/playwright-skill/templates/lambdatest-setup.tsView file

13* Run: L14: * npx playwright test --project=chromium # local L15: * npx playwright test --project="chrome:latest:Windows 11@lambdatest" # cloud ... L19: import { chromium } from 'playwright'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/playwright-skill/templates/lambdatest-setup.tsView on unpkg · L13

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView file

•path = skills/sk[redacted]/scripts/calculate_cost.py kind = build_helper sizeBytes = 12190 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView file

•path = skills/sk[redacted]/tests/test_run_mr_brain_finetune.py kind = payload_in_excluded_dir sizeBytes = 6761 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView on unpkg

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView on unpkg

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L41

96patternName = generic_password severity = medium line = 96

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L96

skills/skills-firebase-apk-scanner/scanner.shView file

524patternName = generic_password severity = medium line = 524

Medium

Secret Pattern

Hardcoded password in skills/skills-firebase-apk-scanner/scanner.sh

skills/skills-firebase-apk-scanner/scanner.shView on unpkg · L524

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/install.js --auto

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/install.js --auto

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView file

22patternName = google_api_key severity = high line = 22

High

High Secret

Package contains a high-severity secret pattern.

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

22patternName = google_api_key severity = high line = 22

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L22

596patternName = google_api_key severity = high line = 596

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L596

742patternName = google_api_key severity = high line = 742

High

Secret Pattern

Google API key in skills/skills-firebase-apk-scanner/references/vulnerabilities.md

skills/skills-firebase-apk-scanner/references/vulnerabilities.mdView on unpkg · L742

bin/install.jsView file

30trigger: path.join(homeDir, '.gemini', 'config'), L31: projectPath: path.join(cwd, '.agents', 'skills'), L32: globalPath: path.join(homeDir, '.gemini', 'config', 'skills'), ... L41: name: 'Claude Code', L42: trigger: path.join(homeDir, '.claude'), L43: projectPath: path.join(cwd, '.claude', 'skills'), L44: globalPath: path.join(homeDir, '.claude', 'skills'), L45: docs: 'https://docs.anthropic.com/en/docs/claude-code/skills', ... L73: name: 'Codex (OpenAI)', L74: trigger: path.join(homeDir, '.agents'), L75: projectPath: path.join(cwd, '.agents', 'skills'), L76: globalPath: path.join(homeDir, '.agents', 'skills'),

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

bin/install.jsView on unpkg · L30

15const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17:

High

Child Process

Package source references child process execution.

bin/install.jsView on unpkg · L15

13const path = require('path'); L14: const http = require('http'); L15: const os = require('os'); L16: const { exec, execSync } = require('child_process'); L17: ... L20: const geminiCmdSrc = path.join(projectRoot, '.gemini', 'commands'); L21: const homeDir = process.env.HOME || process.env.USERPROFILE || os.homedir(); L22: const cwd = process.cwd();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/install.jsView on unpkg · L13

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. unt = count; } } if (mode === 'global' || mode === 'both') { if (isall && shouldlink()) { try { const type = process.platform === 'win32' ? 'junction' : 'dir'; if (fs.existssync(agent.globalpath)) fs.rmsync(agent.globalpath, { recursive: true, force: true }); fs.mkdirsync(path.dirname(agent.globalpath), { recursive: true }); fs.symlinksync(skillssrc, agent.globalpath, type); results.paths.push(`${agent.globalpath} (symlinked all)`); } catch (_) { copyrecursivefiltered(skillssrc, agent.globalpath, selectedcategories); results.paths.push(agent.globalpath); } } else { copyrecursivefilte

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/install.jsView on unpkg

11L12: const fs = require('fs'); L13: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/install.jsView on unpkg · L11

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView file

129for (let i = 0; i < retries; i++) { L130: const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' }); L131: if (result.status === 0) {

High

Shell

Package source references shell execution.

skills/baoyu-post-to-weibo/scripts/paste-from-clipboard.tsView on unpkg · L129

skills/skills-webmcp-gen/scripts/compile.mjsView file

157} L158: if (implementationSource.includes("eval(") || implementationSource.includes("new Function")) { L159: errors.push(`Tool "${tool.name}" uses eval/new Function.`);

High

Eval

Package source references dynamic code evaluation.

skills/skills-webmcp-gen/scripts/compile.mjsView on unpkg · L157

skills/skills-browser-to-api/scripts/infer.mjsView file

98endpoint: ep.endpointKey, L99: request: { status: pickedReqStatus, headers: reqHeaders, body: reqExample }, L100: response: { status: pickedRespStatus, headers: respHeaders, body: respExample },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skills/skills-browser-to-api/scripts/infer.mjsView on unpkg · L98

skills/gstack-browse/src/cookie-import-browser.tsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

skills/gstack-browse/src/cookie-import-browser.tsView on unpkg · L196

skills/gstack-browse/src/cli.tsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

skills/gstack-browse/src/cli.tsView on unpkg · L8

skills/postiz-agent-postiz/src/commands/auth.tsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

skills/postiz-agent-postiz/src/commands/auth.tsView on unpkg · L5

skills/humanizer-ru/demo/markers.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

skills/humanizer-ru/demo/markers.jsView on unpkg · L206

skills/playwright-skill/templates/lambdatest-setup.tsView file

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/playwright-skill/templates/lambdatest-setup.tsView on unpkg · L13

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView file

•path = skills/sk[redacted]/scripts/calculate_cost.py kind = build_helper sizeBytes = 12190 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/skills-agent-platform-tuning/scripts/calculate_cost.pyView on unpkg

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/theme-factory/theme-showcase.pdfView file

•path = skills/theme-factory/theme-showcase.pdf kind = high_entropy_blob sizeBytes = 124310 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/theme-factory/theme-showcase.pdfView on unpkg

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView file

•path = skills/sk[redacted]/tests/test_run_mr_brain_finetune.py kind = payload_in_excluded_dir sizeBytes = 6761 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.pyView on unpkg

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 24

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

skills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjsView on unpkg

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView file

41patternName = generic_password severity = medium line = 41

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L41

96patternName = generic_password severity = medium line = 96

Medium

Secret Pattern

Hardcoded password in skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

skills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.shView on unpkg · L96

skills/skills-firebase-apk-scanner/scanner.shView file

524patternName = generic_password severity = medium line = 524

Medium

Secret Pattern

Hardcoded password in skills/skills-firebase-apk-scanner/scanner.sh

skills/skills-firebase-apk-scanner/scanner.shView on unpkg · L524

Findings

3 Critical16 High10 Medium5 Low

CriticalCredential Exfiltrationskills/gstack-browse/src/cookie-import-browser.ts

CriticalAi Agent Control Hijackbin/install.js

CriticalTrojan Source Unicodeskills/humanizer-ru/demo/markers.js

HighInstall Time Lifecycle Scriptspackage.json

HighHigh Secretskills/skills-firebase-apk-scanner/references/vulnerabilities.md

HighChild Processbin/install.js

HighShellskills/baoyu-post-to-weibo/scripts/paste-from-clipboard.ts

HighEvalskills/skills-webmcp-gen/scripts/compile.mjs

HighSame File Env Network Executionbin/install.js

HighCommand Output Exfiltrationskills/gstack-browse/src/cli.ts

HighSandbox Evasion Gated Capabilityskills/postiz-agent-postiz/src/commands/auth.ts

HighTrigger Reachable External Ai Agent Control Surface Mutationbin/install.js

HighRuntime Package Installskills/playwright-skill/templates/lambdatest-setup.ts

HighShips High Entropy Blobskills/theme-factory/theme-showcase.pdf

HighPayload In Excluded Dirskills/skills-nv-generate-mr-brain-finetune/tests/test_run_mr_brain_finetune.py

HighSemantic Analysis Limitedskills/ai-dev-kit/references/coding-standards/tooling/stylelint.config.cjs

HighSecret Patternskills/skills-firebase-apk-scanner/references/vulnerabilities.md

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/install.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/skills-agent-platform-tuning/scripts/calculate_cost.py

MediumShips Compressed Blobskills/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/skills-physical-ai-infrastructure-setup-and-resilient-scaling/components/inference-nim-operator/scripts/install.sh

MediumSecret Patternskills/skills-firebase-apk-scanner/scanner.sh

LowScripts Present

LowWeak Cryptoskills/skills-browser-to-api/scripts/infer.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings