sensitive-data-2aa6e1 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sensitive-data-2aa6e1 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<sensitive_data>
<process>
[REDACTED:<type>] (e.g. [REDACTED:API_KEY], [REDACTED:PASSWORD])Bearer , Authorization:, password:, api_key=, client_secret, eyJ (JWT), AKIA (AWS key), ghp_/gho_/github_pat_ (GitHub), xox[baprs]- (Slack), BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY, BEGIN OPENSSH PRIVATE KEY, postgresql://user:pass@, mongodb+srv://user:pass@; plus emails outside example.com/example.org, phones outside the +1-555-01xx reserved range, card-number shapes \d{4}[\s\-]\d{4}[\s\-]\d{4}[\s\-]\d{4}, and real customer names alongside any of the above. This list is a non-exhaustive floor -- redact any secret-shaped token even if unlisted. Fail-closed -- if the scan cannot run, do not emit[email protected]; phones +1-555-0100–+1-555-0199; official PSP test cards (cite source)</process>
<coding>
</coding>
<pitfalls>
</pitfalls>
</sensitive_data>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.