中文 EN
Start Review
Risk Sample Stream

Which skills recently failed
or triggered trust review

This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.

610 Risky samples surfaced
0 New in 7 days
0 Platform misses surfaced
All Malicious High Risk Suspicious
Sort by time Sort by risk
All Code Exec Credential Theft Data Exfil Priv Esc Supply Chain Doc Deception Prompt Injection Obfuscation
68 /100
Trust
Review

cms-meeting-monitor

Undeclared cross-skill subprocess execution

Doc MismatchPriv EscalationSupply ChainSensitive Access
Manual upload Apr 4, 2026
Open Report ↗
30 /100
Trust
High Risk

product-demo-video

Destructive `rm -rf` glob command in install script

RCEDoc MismatchSupply ChainPriv Escalation
Manual upload Apr 4, 2026
Open Report ↗
32 /100
Trust
High Risk

deepsafe-scan

Network access not declared in SKILL.md

Doc MismatchPriv EscalationCredential TheftSensitive Access
Manual upload Apr 4, 2026
Open Report ↗
62 /100
Trust
Review

China Stock Sentiment

Undeclared shell execution via child_process.execSync

Doc MismatchPriv Escalation
Manual upload Apr 4, 2026
Open Report ↗
32 /100
Trust
High Risk

kuaidi-query

Hardcoded API Credentials Exposed

Credential TheftPriv EscalationSupply ChainDoc Mismatch
Manual upload Apr 4, 2026
Open Report ↗
50 /100
Trust
Review

promptbuddy

Missing Implementation Files

Doc MismatchPriv EscalationSensitive Access
Manual upload Apr 4, 2026
Open Report ↗
50 /100
Trust
Review

swarmrecall

Comprehensive agent context exfiltration to third-party

Data ExfilCredential TheftPriv EscalationSupply Chain
Manual upload Apr 4, 2026
Open Report ↗
60 /100
Trust
Review

openclaw-usage-manager

API tokens stored in plaintext on disk

Credential TheftDoc MismatchPriv EscalationObfuscation
Manual upload Apr 4, 2026
Open Report ↗
45 /100
Trust
Review

search

Hardcoded API Credential in Source Code

Credential TheftData ExfilDoc MismatchSupply Chain
Manual upload Apr 4, 2026
Open Report ↗
60 /100
Trust
Review

lock-me-in

Undeclared stealth/anti-detection browser scripts

Doc MismatchRCEPriv EscalationSupply Chain
Manual upload Apr 4, 2026
Open Report ↗
35 /100
Trust
High Risk

task-progress-stream

Undeclared shell command execution

Priv EscalationDoc Mismatch
Manual upload Apr 4, 2026
Open Report ↗
55 /100
Trust
Review

calendar_memo

Undeclared shell command execution

Priv EscalationRCEPersistenceDoc Mismatch
Manual upload Apr 4, 2026
Open Report ↗
40 /100
Trust
Review

MemOptimizer (记忆优化器)

Undeclared shell execution via child_process.exec()

Doc MismatchSensitive AccessPriv Escalation
Manual upload Apr 4, 2026
Open Report ↗
55 /100
Trust
Review

feishu-evolver-wrapper

Dynamic code evaluation on untrusted input

ObfuscationPriv EscalationDoc MismatchPrompt Injection
Manual upload Apr 4, 2026
Open Report ↗
45 /100
Trust
Review

buy-domain-helper

Undeclared shell execution via execSync and spawn

Priv EscalationSupply ChainDoc MismatchRCE
Manual upload Apr 4, 2026
Open Report ↗
28 /100
Trust
High Risk

飞书机器人配置助手

文档中记录curl|bash远程脚本执行命令

Supply ChainPriv EscalationDoc MismatchSensitive Access
Manual upload Apr 4, 2026
Open Report ↗
← Previous
10 / 11
Next →