Skip to content

[Scan Request] hoodini #6

New issue
New issue
Open
Open
[Scan Request] hoodini#6
Labels
scan-completedscan-request

Description

@levinebw
levinebw
opened on Apr 16, 2026

Repository URL

https://github.com/hoodini/ai-agents-skills

Reason / Description

Testing community scan workflow

Acknowledgement

  • I confirm this is a public GitHub repository containing AI agent skills (SKILL.md files)

Activity

  1. levinebw
    added
    scan-request
    on Apr 16, 2026
  2. AppSecHQ
    deleted a comment from github-actions on Apr 16, 2026
  3. AppSecHQ
    deleted a comment from github-actions on Apr 16, 2026

  4. levinebw commented on Apr 16, 2026

    @levinebw
    levinebw
    on Apr 16, 2026
    ContributorAuthor

    /approve

  5. github-actions
    added
    scanning
    on Apr 16, 2026

  6. github-actions commented on Apr 16, 2026

    @github-actions
    github-actionsBot
    on Apr 16, 2026 – with GitHub Actions
    Contributor

    Scan approved by @levinebw. Scanning hoodini/ai-agents-skills...

    This may take a few minutes.

  7. github-actions commented on Apr 16, 2026

    @github-actions
    github-actionsBot
    on Apr 16, 2026 – with GitHub Actions
    Contributor

    Scan Results for hoodini/ai-agents-skills

    Metric Count
    Skills Found 26
    Safe 25
    Issues Found 1
    Errors 0
    Total Findings 30

    Per-Skill Results

    Skill Safe Findings Max Severity
    local-llm-router Yes 3 MEDIUM
    bun Yes 2 LOW
    langchain No 2 HIGH
    skill-name Yes 1 INFO
    aws-strands Yes 1 INFO
    copilot-docs Yes 1 INFO
    github-trending Yes 1 INFO
    vercel Yes 1 INFO
    shabbat-times Yes 1 INFO
    honest-agent Yes 1 INFO
    cloudflare Yes 1 INFO
    copilot-sdk Yes 1 INFO
    mongodb Yes 1 INFO
    mobile-responsiveness Yes 1 INFO
    figma Yes 1 INFO
    aws-account-management Yes 1 INFO
    google-workspace-cli Yes 1 INFO
    web-accessibility Yes 1 INFO
    ux-design-systems Yes 1 INFO
    analytics-metrics Yes 1 INFO
    railway Yes 1 INFO
    mermaid-diagrams Yes 1 INFO
    nano-banana-pro Yes 1 INFO
    fal-ai Yes 1 INFO
    aws-agentcore Yes 1 INFO
    owasp-security Yes 1 INFO

    Findings: skill-name

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-strands

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: bun

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://bun.sh/install | bash. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)

    Findings: copilot-docs

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: github-trending

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: vercel

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: local-llm-router

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Python code block executes shell commands

    • Rule: MDBLOCK_PYTHON_SUBPROCESS | Category: command_injection
    • Code block in SKILL.md at line 99 contains potentially dangerous Python code.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://ollama.ai/install.sh | sh. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)

    Findings: shabbat-times

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: honest-agent

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: cloudflare

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: copilot-sdk

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mongodb

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mobile-responsiveness

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: figma

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-account-management

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: google-workspace-cli

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: web-accessibility

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: ux-design-systems

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: langchain

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [HIGH] Python code block uses eval/exec

    • Rule: MDBLOCK_PYTHON_EVAL_EXEC | Category: command_injection
    • Code block in SKILL.md at line 95 contains potentially dangerous Python code.

    Findings: analytics-metrics

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: railway

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mermaid-diagrams

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: nano-banana-pro

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: fal-ai

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-agentcore

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: owasp-security

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Results have been published to the dashboard.

  8. github-actions
    added
    scan-failed
    and removed
    scanning
    on Apr 16, 2026
  9. levinebw
    removed
    scan-failed
    on Apr 18, 2026

  10. levinebw commented on Apr 18, 2026

    @levinebw
    levinebw
    on Apr 18, 2026
    ContributorAuthor

    /approve

  11. levinebw commented on Apr 18, 2026

    @levinebw
    levinebw
    on Apr 18, 2026
    ContributorAuthor

    /approve

  12. github-actions commented on Apr 18, 2026

    @github-actions
    github-actionsBot
    on Apr 18, 2026 – with GitHub Actions
    Contributor

    Scan approved by @levinebw. Scanning hoodini/ai-agents-skills...

    This may take a few minutes.

  13. github-actions
    added
    scanning
    on Apr 18, 2026

  14. github-actions commented on Apr 18, 2026

    @github-actions
    github-actionsBot
    on Apr 18, 2026 – with GitHub Actions
    Contributor

    Scan Results for hoodini/ai-agents-skills

    Metric Count
    Skills Found 26
    Safe 25
    Issues Found 1
    Errors 0
    Total Findings 30

    Per-Skill Results

    Skill Safe Findings Max Severity
    local-llm-router Yes 3 MEDIUM
    bun Yes 2 LOW
    langchain No 2 HIGH
    skill-name Yes 1 INFO
    aws-strands Yes 1 INFO
    copilot-docs Yes 1 INFO
    github-trending Yes 1 INFO
    vercel Yes 1 INFO
    shabbat-times Yes 1 INFO
    honest-agent Yes 1 INFO
    cloudflare Yes 1 INFO
    copilot-sdk Yes 1 INFO
    mongodb Yes 1 INFO
    mobile-responsiveness Yes 1 INFO
    figma Yes 1 INFO
    aws-account-management Yes 1 INFO
    google-workspace-cli Yes 1 INFO
    web-accessibility Yes 1 INFO
    ux-design-systems Yes 1 INFO
    analytics-metrics Yes 1 INFO
    railway Yes 1 INFO
    mermaid-diagrams Yes 1 INFO
    nano-banana-pro Yes 1 INFO
    fal-ai Yes 1 INFO
    aws-agentcore Yes 1 INFO
    owasp-security Yes 1 INFO

    Findings: skill-name

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-strands

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: bun

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://bun.sh/install | bash. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)

    Findings: copilot-docs

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: github-trending

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: vercel

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: local-llm-router

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Python code block executes shell commands

    • Rule: MDBLOCK_PYTHON_SUBPROCESS | Category: command_injection
    • Code block in SKILL.md at line 99 contains potentially dangerous Python code.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://ollama.ai/install.sh | sh. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)

    Findings: shabbat-times

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: honest-agent

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: cloudflare

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: copilot-sdk

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mongodb

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mobile-responsiveness

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: figma

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-account-management

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: google-workspace-cli

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: web-accessibility

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: ux-design-systems

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: langchain

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [HIGH] Python code block uses eval/exec

    • Rule: MDBLOCK_PYTHON_EVAL_EXEC | Category: command_injection
    • Code block in SKILL.md at line 95 contains potentially dangerous Python code.

    Findings: analytics-metrics

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: railway

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mermaid-diagrams

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: nano-banana-pro

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: fal-ai

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-agentcore

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: owasp-security

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    A PR has been opened to publish these results to the dashboard.

  15. github-actions
    added
    scan-failed
    and removed
    scanning
    on Apr 18, 2026

  16. levinebw commented on May 9, 2026

    @levinebw
    levinebw
    on May 9, 2026
    ContributorAuthor

    /approve

  17. github-actions
    added
    scanning
    on May 9, 2026

  18. github-actions commented on May 9, 2026

    @github-actions
    github-actionsBot
    on May 9, 2026 – with GitHub Actions
    Contributor

    Scan approved by @levinebw. Scanning hoodini/ai-agents-skills...

    This may take a few minutes.

  19. github-actions commented on May 9, 2026

    @github-actions
    github-actionsBot
    on May 9, 2026 – with GitHub Actions
    Contributor

    Scan Results for hoodini/ai-agents-skills

    Metric Count
    Skills Found 29
    Safe 25
    Issues Found 2
    Errors 2
    Total Findings 43

    Per-Skill Results

    Skill Safe Findings Max Severity
    meta-ads No 13 CRITICAL
    local-llm-router Yes 3 MEDIUM
    bun Yes 2 LOW
    langchain No 2 HIGH
    skill-name Yes 1 INFO
    aws-strands Yes 1 INFO
    copilot-docs Yes 1 INFO
    github-trending Yes 1 INFO
    vercel Yes 1 INFO
    shabbat-times Yes 1 INFO
    honest-agent Yes 1 INFO
    cloudflare Yes 1 INFO
    copilot-sdk Yes 1 INFO
    mongodb Yes 1 INFO
    mobile-responsiveness Yes 1 INFO
    figma Yes 1 INFO
    aws-account-management Yes 1 INFO
    google-workspace-cli Yes 1 INFO
    web-accessibility Yes 1 INFO
    ux-design-systems Yes 1 INFO
    analytics-metrics Yes 1 INFO
    railway Yes 1 INFO
    mermaid-diagrams Yes 1 INFO
    nano-banana-pro Yes 1 INFO
    fal-ai Yes 1 INFO
    aws-agentcore Yes 1 INFO
    owasp-security Yes 1 INFO
    skills-yuv-design Error 0 ERROR
    skills-yuv-viral-video Error 0 ERROR

    Findings: skill-name

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-strands

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: bun

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://bun.sh/install | bash. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)

    Findings: copilot-docs

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: github-trending

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: vercel

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: local-llm-router

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Python code block executes shell commands

    • Rule: MDBLOCK_PYTHON_SUBPROCESS | Category: command_injection
    • Code block in SKILL.md at line 99 contains potentially dangerous Python code.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://ollama.ai/install.sh | sh. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)

    Findings: shabbat-times

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: honest-agent

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: cloudflare

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: copilot-sdk

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mongodb

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mobile-responsiveness

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: figma

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-account-management

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: google-workspace-cli

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: web-accessibility

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: ux-design-systems

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: langchain

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [HIGH] Python code block uses eval/exec

    • Rule: MDBLOCK_PYTHON_EVAL_EXEC | Category: command_injection
    • Code block in SKILL.md at line 95 contains potentially dangerous Python code.

    Findings: analytics-metrics

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: railway

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mermaid-diagrams

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: nano-banana-pro

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: meta-ads

    [CRITICAL] Cross-file env var exfiltration: 3 files

    • Rule: BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Environment variable access with network calls in scripts/exchange_token.py, scripts/meta_client.py

    [CRITICAL] Cross-file exfiltration chain: 3 files

    • Rule: BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN | Category: data_exfiltration
    • Multi-file exfiltration chain detected: scripts/exchange_token.py, scripts/meta_client.py collect data → encode → scripts/exchange_token.py, scripts/meta_client.py, scripts/create_campaign.py transmit to network

    [MEDIUM] Undeclared network usage

    • Rule: TOOL_ABUSE_UNDECLARED_NETWORK | Category: unauthorized_tool_use
    • Skill code uses network libraries but doesn't declare network requirement

    [CRITICAL] Environment variable access with network calls detected

    • Rule: BEHAVIOR_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py

    [MEDIUM] Environment variable harvesting detected

    • Rule: BEHAVIOR_ENV_VAR_HARVESTING | Category: data_exfiltration
    • Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py

    [CRITICAL] Environment variable access with network calls detected

    • Rule: BEHAVIOR_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py

    [MEDIUM] Environment variable harvesting detected

    • Rule: BEHAVIOR_ENV_VAR_HARVESTING | Category: data_exfiltration
    • Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.post(

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.get(

    [CRITICAL] PROMPT INJECTION detected by YARA

    • Rule: YARA_coercive_injection_generic | Category: prompt_injection
    • Detects coercive prompt injections in tool description fields: hidden input

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.request(

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.get(

    Findings: fal-ai

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-agentcore

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: owasp-security

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    A PR has been opened to publish these results to the dashboard.

  20. github-actions
    removed
    scanning
    on May 9, 2026
  21. levinebw
    removed
    scan-failed
    on May 9, 2026

  22. levinebw commented on May 9, 2026

    @levinebw
    levinebw
    on May 9, 2026
    ContributorAuthor

    /approve

  23. github-actions
    added
    scanning
    on May 9, 2026

  24. github-actions commented on May 9, 2026

    @github-actions
    github-actionsBot
    on May 9, 2026 – with GitHub Actions
    Contributor

    Scan approved by @levinebw. Scanning hoodini/ai-agents-skills...

    This may take a few minutes.

  25. github-actions commented on May 9, 2026

    @github-actions
    github-actionsBot
    on May 9, 2026 – with GitHub Actions
    Contributor

    Scan Results for hoodini/ai-agents-skills

    Metric Count
    Skills Found 29
    Safe 25
    Issues Found 2
    Errors 2
    Total Findings 43

    Per-Skill Results

    Skill Safe Findings Max Severity
    meta-ads No 13 CRITICAL
    local-llm-router Yes 3 MEDIUM
    bun Yes 2 LOW
    langchain No 2 HIGH
    skill-name Yes 1 INFO
    aws-strands Yes 1 INFO
    copilot-docs Yes 1 INFO
    github-trending Yes 1 INFO
    vercel Yes 1 INFO
    shabbat-times Yes 1 INFO
    honest-agent Yes 1 INFO
    cloudflare Yes 1 INFO
    copilot-sdk Yes 1 INFO
    mongodb Yes 1 INFO
    mobile-responsiveness Yes 1 INFO
    figma Yes 1 INFO
    aws-account-management Yes 1 INFO
    google-workspace-cli Yes 1 INFO
    web-accessibility Yes 1 INFO
    ux-design-systems Yes 1 INFO
    analytics-metrics Yes 1 INFO
    railway Yes 1 INFO
    mermaid-diagrams Yes 1 INFO
    nano-banana-pro Yes 1 INFO
    fal-ai Yes 1 INFO
    aws-agentcore Yes 1 INFO
    owasp-security Yes 1 INFO
    skills-yuv-design Error 0 ERROR
    skills-yuv-viral-video Error 0 ERROR

    Findings: skill-name

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-strands

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: bun

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://bun.sh/install | bash. This is a remote code execution pattern. (Note: uses a well-known installer URL - likely a standard installation command.)

    Findings: copilot-docs

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: github-trending

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: vercel

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: local-llm-router

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Python code block executes shell commands

    • Rule: MDBLOCK_PYTHON_SUBPROCESS | Category: command_injection
    • Code block in SKILL.md at line 99 contains potentially dangerous Python code.

    [LOW] Dangerous data flow in command pipeline

    • Rule: PIPELINE_TAINT_FLOW | Category: command_injection
    • Pipeline downloads data from the network and executes it: curl -fsSL https://ollama.ai/install.sh | sh. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)

    Findings: shabbat-times

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: honest-agent

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: cloudflare

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: copilot-sdk

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mongodb

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mobile-responsiveness

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: figma

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-account-management

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: google-workspace-cli

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: web-accessibility

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: ux-design-systems

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: langchain

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [HIGH] Python code block uses eval/exec

    • Rule: MDBLOCK_PYTHON_EVAL_EXEC | Category: command_injection
    • Code block in SKILL.md at line 95 contains potentially dangerous Python code.

    Findings: analytics-metrics

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: railway

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: mermaid-diagrams

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: nano-banana-pro

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: meta-ads

    [CRITICAL] Cross-file env var exfiltration: 3 files

    • Rule: BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Environment variable access with network calls in scripts/exchange_token.py, scripts/meta_client.py

    [CRITICAL] Cross-file exfiltration chain: 3 files

    • Rule: BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN | Category: data_exfiltration
    • Multi-file exfiltration chain detected: scripts/exchange_token.py, scripts/meta_client.py collect data → encode → scripts/exchange_token.py, scripts/meta_client.py, scripts/create_campaign.py transmit to network

    [MEDIUM] Undeclared network usage

    • Rule: TOOL_ABUSE_UNDECLARED_NETWORK | Category: unauthorized_tool_use
    • Skill code uses network libraries but doesn't declare network requirement

    [CRITICAL] Environment variable access with network calls detected

    • Rule: BEHAVIOR_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py

    [MEDIUM] Environment variable harvesting detected

    • Rule: BEHAVIOR_ENV_VAR_HARVESTING | Category: data_exfiltration
    • Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/exchange_token.py

    [CRITICAL] Environment variable access with network calls detected

    • Rule: BEHAVIOR_ENV_VAR_EXFILTRATION | Category: data_exfiltration
    • Script accesses environment variables and makes network calls in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py

    [MEDIUM] Environment variable harvesting detected

    • Rule: BEHAVIOR_ENV_VAR_HARVESTING | Category: data_exfiltration
    • Script iterates through environment variables in ../skills/hoodini-ai-agents-skills/skills/meta-ads/scripts/meta_client.py

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.post(

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.get(

    [CRITICAL] PROMPT INJECTION detected by YARA

    • Rule: YARA_coercive_injection_generic | Category: prompt_injection
    • Detects coercive prompt injections in tool description fields: hidden input

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.request(

    [MEDIUM] Outbound network request primitives that can transmit data externally

    • Rule: DATA_EXFIL_NETWORK_REQUESTS | Category: data_exfiltration
    • Pattern detected: requests.get(

    Findings: fal-ai

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: aws-agentcore

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    Findings: owasp-security

    [INFO] Skill does not specify a license

    • Rule: MANIFEST_MISSING_LICENSE | Category: policy_violation
    • Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

    A PR has been opened to publish these results to the dashboard.

  26. github-actions
    added
    scan-completed
    and removed
    scanning
    on May 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    scan-completedscan-request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions