Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
High Risk
minimax-web-search
Hardcoded API Key in Source Code
Manual upload Apr 4, 2026
Open Report ↗
High Risk
minimax-cp
Hardcoded MiniMax API Key Exposed
Manual upload Apr 4, 2026
Open Report ↗
Review
risk-analysis
Hardcoded MySQL credentials in config.yaml
Manual upload Apr 4, 2026
Open Report ↗
Review
isnad-security-kit
installer.js performs zero actual installation
Manual upload Apr 4, 2026
Open Report ↗
Review
rundev-local-dev
Dangerous curl|bash Installation Pattern
Manual upload Apr 4, 2026
Open Report ↗
Review
cogdx-health
Missing allowed-tools declaration
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-customer-service-automation
Declared functionality has no implementation
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-enterprise-knowledge-base
Remote code execution via git clone
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-intelligent-helpdesk
No implementation code present
Manual upload Apr 4, 2026
Open Report ↗
High Risk
recruit-email-monitor
Hardcoded QQ Email Authorization Code
Manual upload Apr 4, 2026
Open Report ↗
Review
turing-pot-biglog
Undeclared base64 encoding of WebSocket messages
Manual upload Apr 4, 2026
Open Report ↗
High Risk
shekel-hyperliquid
Mandatory dynamic instruction fetching — silent remote code replacement
Manual upload Apr 4, 2026
Open Report ↗
Review
colmena-manager
Command injection via agentId in multiple exec() calls
Manual upload Apr 4, 2026
Open Report ↗
Review
x-scout
Silent phone-home analytics on every execution
Manual upload Apr 4, 2026
Open Report ↗
Review
ecommerce-category-collector
Hardcoded credentials in documentation
Manual upload Apr 4, 2026
Open Report ↗
Review
palette
Core color theory functionality not implemented
Manual upload Apr 4, 2026
Open Report ↗