Which skills recently failed
or triggered trust review
This is not a popularity board. It shows recently reviewed skills that the system believes should be blocked or at least manually reviewed. The point is not how popular they are, but why they should not be installed blindly.
Review
x-scout
Silent phone-home analytics on every execution
Manual upload Apr 4, 2026
Open Report ↗
Review
ecommerce-category-collector
Hardcoded credentials in documentation
Manual upload Apr 4, 2026
Open Report ↗
Review
palette
Core color theory functionality not implemented
Manual upload Apr 4, 2026
Open Report ↗
Review
semanticfs
Dangerous curl|bash remote script execution
Manual upload Apr 4, 2026
Open Report ↗
High Risk
token-sop
Automatic workflow contribution enabled by default
Manual upload Apr 4, 2026
Open Report ↗
Review
ai-content-pipeline
Production API credentials in .env file
Manual upload Apr 4, 2026
Open Report ↗
Review
clawschool
Undeclared shell execution requirement
Manual upload Apr 4, 2026
Open Report ↗
High Risk
mind-wander
Undeclared arbitrary Python code execution via sandbox_run()
Manual upload Apr 4, 2026
Open Report ↗
High Risk
stremio-cli
Explicit false statement about script status
Manual upload Apr 4, 2026
Open Report ↗
Review
file-transfer-thru-local-workspace
Undeclared credential file access
Manual upload Apr 4, 2026
Open Report ↗
Review
feynman-fsrs-pro
Database credentials exposed in SKILL.md
Manual upload Apr 4, 2026
Open Report ↗
High Risk
Enterprise Security
Undeclared shell execution via execSync
Manual upload Apr 4, 2026
Open Report ↗
High Risk
moltspay_skill
Untrusted third-party npm package installed without pinning
Manual upload Apr 4, 2026
Open Report ↗
Review
run402-test
Documentation mismatch - curl examples vs actual implementation
Manual upload Apr 4, 2026
Open Report ↗
High Risk
minimal-agent
Unrestricted Arbitrary Command Execution via V1 Mode
Manual upload Apr 4, 2026
Open Report ↗
High Risk
maxianer
Undeclared external data transmission
Manual upload Apr 4, 2026
Open Report ↗