Scan Report
5 /100
skill-index
Auto-scan all installed skills, generate a categorized INDEX.md, and keep it in sync via git hooks.
Legitimate skill indexer that scans SKILL.md files and generates an INDEX.md catalog with git hook auto-update functionality. No malicious behavior detected.
Safe to install
Skill is safe to use. Consider adding explicit allowed-tools declaration in SKILL.md for completeness.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Missing allowed-tools declaration | SKILL.md:1 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Shell | NONE | WRITE | ✓ Aligned | install-hooks.sh:1, register.sh:1 - both start with #!/bin/bash |
| Filesystem | NONE | WRITE | ✓ Aligned | register.sh writes to skills/INDEX.md; install-hooks.sh writes to .git/hooks/ |
File Tree
3 files · 8.6 KB · 251 lines Shell 2f · 172L
Markdown 1f · 79L
├─
install-hooks.sh
Shell
├─
register.sh
Shell
└─
SKILL.md
Markdown
Security Positives
✓ No network requests or external data transmission
✓ No credential access (no ~/.ssh, ~/.aws, .env access)
✓ No base64 encoding/decoding or eval statements
✓ No remote script execution (curl|bash, wget|sh)
✓ No hidden functionality - code is straightforward and matches documentation
✓ Git hooks are clearly scoped to skill index updates only
✓ No data exfiltration or suspicious outbound connections
✓ Uses mktemp with trap for safe temporary file handling
✓ Uses sort -z for null-delimited processing (safe with filenames)