Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
crewai-team
Hardcoded API credential in 15 Python files
Manual upload Apr 4, 2026
Open Report ↗
Review
instreet-gomoku
Hardcoded API credential in source code
Manual upload Apr 4, 2026
Open Report ↗
Review
PV_12
Vague capability claims without verification
Manual upload Apr 4, 2026
Open Report ↗
Review
okx-security
Remote installer download and execution
Manual upload Apr 4, 2026
Open Report ↗
Review
risk-analysis
Hardcoded MySQL credentials in config.yaml
Manual upload Apr 4, 2026
Open Report ↗
Review
rundev-local-dev
Dangerous curl|bash Installation Pattern
Manual upload Apr 4, 2026
Open Report ↗
Review
cogdx-health
Missing allowed-tools declaration
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-enterprise-knowledge-base
Remote code execution via git clone
Manual upload Apr 4, 2026
Open Report ↗
Review
turing-pot-biglog
Undeclared base64 encoding of WebSocket messages
Manual upload Apr 4, 2026
Open Report ↗
Review
x-scout
Silent phone-home analytics on every execution
Manual upload Apr 4, 2026
Open Report ↗
Review
semanticfs
Dangerous curl|bash remote script execution
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-content-pipeline
Production API credentials in .env file
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-beauty
Contradictory claim of local-only processing
Manual upload Apr 4, 2026
Open Report ↗
Review
cms-meeting-monitor
Undeclared cross-skill subprocess execution
Manual upload Apr 4, 2026
Open Report ↗
Review
likes-training-planner
Dangerous curl|bash installation pattern
Manual upload Apr 4, 2026
Open Report ↗
Review
lessac_offline_voice_system
False claim of offline operation
Manual upload Apr 4, 2026
Open Report ↗