highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/benchling-integration/references/authentication.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/genomic-intelligence/SKILL.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/genomic-intelligence/references/api-and-auth.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/gguf-quantization/SKILL.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/gguf-quantization/references/troubleshooting.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/huggingface-tokenizers/references/tokenization-algorithms.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/labarchive-integration/scripts/setup_config.py.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/llama-factory/references/advanced.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/nemo-evaluator-sdk/references/adapter-system.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/nemo-evaluator-sdk/references/configuration.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/phoenix-observability/SKILL.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/pi-agent/references/custom-provider.md.
Remove the secret from source control and load it securely at runtime.
highsecurityHARDCODED_SECRETReported 2 times
Potential secret material was detected in skills/qiskit/references/setup.md.
Remove the secret from source control and load it securely at runtime.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl https://foundry-api-public.adaptyvbio.com/api/v1/targets?limit=3" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -X POST -H "Content-Type: application/json" -d '{"query":"..."}' https://api.platform.opentargets.org/api/v4/graphql" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl --silent --show-error --fail-with-body --max-time 60 -X POST https://api.helena.bio/folklore/v1/mcp" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -s https://openrouter.ai/api/v1/images" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -u $LAMBDA_API_KEY: https://cloud.lambdalabs.com/api/v1/instance-types" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "~/.ssh" and references sensitive SSH material.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -sL https://example.com/report.pdf" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -fsSL https://parallel.ai/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl http://localhost:8080/v1/chat/completions" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -X POST http://localhost:8000/moderate" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl http://127.0.0.1:5001/invocations" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -s https://get.nextflow.io" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -o docker-compose.yml https://raw.githubusercontent.com/lfnovo/open-notebook/main/docker-compose.yml" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -s --get "https://www.ebi.ac.uk/europepmc/webservices/rest/search" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
highskill-securityRISKY_SKILL_INSTRUCTION
The skill includes "curl -fsSL https://paperclip.gxl.ai/install.sh" and uses curl with uploads, shell composition, or arguments requiring review.
Remove instructions that read sensitive local files, launch shell wrappers, or send workspace data to remote endpoints.
lowoperational-securityDEPENDABOT_MISSINGReported 2 times
Automation or dependency surfaces exist, but .github/dependabot.yml is missing.
Add Dependabot updates for GitHub Actions and dependency manifests.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL
The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.
Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL
The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.
Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON
The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.
Update "composerIcon" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO
The interface field "logo" must use HTTPS or point to a safe in-repo asset.
Update "logo" to use HTTPS or an existing relative asset path.
infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS
The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.
Update "screenshots" to use HTTPS or an existing relative asset path.
infobest-practicesCODEXIGNORE_MISSING
A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.
Add a .codexignore file with generated assets, local state, and secret paths.