github TypeScript analyzed cd9623c

harshsinghmp/skills

Curated Downstream Agent Skills Hub with Automated Upstream Ingestion & Sync

Drift inferred · capture-to-capture

HIGH 2026-09-15 code analysis flagged hidden prompt content in harshsinghmp/skills

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit cd9623c · analyzer v33 · 3d ago

hidden: skill: skill-exfil harshsinghmp-skills-cd9623c/skills/new-project/SKILL.md :292 secret→sink: 3. Wire `next.config.mjs` with `withPayload` and add `"@payload-config": ["./src/payload.config.ts"]` to `tsconfig.json` paths.

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 45

fs (weak) harshsinghmp-skills-cd9623c/skills/brainstorming/scripts/server.cjs :3 const fs = require('fs');
fs (weak) harshsinghmp-skills-cd9623c/skills/new-project/scripts/new-project.ts :22 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, rmSync, chmodSync } from "node:fs";
fs (weak) harshsinghmp-skills-cd9623c/skills/updateagents/scripts/updateagents.ts :25 import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, statSync, cpSync, renameSync } from "node:fs";
fs harshsinghmp-skills-cd9623c/src/discover.ts :2 import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
fs harshsinghmp-skills-cd9623c/src/ingest.ts :1 import { readFileSync } from "node:fs";
fs harshsinghmp-skills-cd9623c/src/manifest.ts :1 import { existsSync, readFileSync, writeFileSync } from "node:fs";
fs harshsinghmp-skills-cd9623c/src/sync.ts :12 } from "node:fs";
fs harshsinghmp-skills-cd9623c/src/validator.ts :1 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";

shell (weak) harshsinghmp-skills-cd9623c/skills/brainstorming/scripts/server.cjs :537 const cp = require('child_process');
shell (weak) harshsinghmp-skills-cd9623c/skills/new-project/scripts/new-project.ts :27 import { spawnSync } from "node:child_process";
shell (weak) harshsinghmp-skills-cd9623c/skills/updateagents/scripts/updateagents.ts :28 import { spawnSync } from "node:child_process";
shell harshsinghmp-skills-cd9623c/src/discover.ts :1 import { execSync } from "node:child_process";
shell harshsinghmp-skills-cd9623c/src/sync.ts :1 import { execSync } from "node:child_process";

net (weak) harshsinghmp-skills-cd9623c/skills/brainstorming/scripts/server.cjs :2 const http = require('http');
net (weak) harshsinghmp-skills-cd9623c/skills/new-project/scripts/new-project.ts :3712 const response = await fetch(endpoint, {
net harshsinghmp-skills-cd9623c/src/discover.ts :25 return fetch(url, { headers });

secrets (weak) harshsinghmp-skills-cd9623c/skills/brainstorming/scripts/server.cjs :133 if (process.env.BRAINSTORM_TOKEN) {
secrets (weak) harshsinghmp-skills-cd9623c/skills/new-project/scripts/new-project.ts :2253 secret: process.env.PAYLOAD_SECRET || '${randomBytes(32).toString("base64url")}',
secrets harshsinghmp-skills-cd9623c/src/sync.ts :143 const token = options.token || process.env.GITHUB_TOKEN;