libukai/awesome-agent-skills

Score 0. Found 28 critical, 9 medium, 1 low findings.

https://github.com/libukai/awesome-agent-skillsScanned April 29, 2026 at 12:21 PM

Scan another skill →

Trust score

0/ 100

Score 0. Found 28 critical, 9 medium, 1 low findings.

libukai/awesome-agent-skills · 50 of 2679 files read

Critical28

skills/obsidian-to-x/scripts/obsidian-resolver.ts:39 · shell_exec
Spawns a subprocess.
```
const result = spawnSync('obsidian', ['file', `file=${filename}`], {
```
skills/obsidian-to-x/scripts/paste-from-clipboard.ts:54 · shell_exec
Spawns a subprocess.
```
const result = spawnSync('osascript', ['-e', script], { stdio: 'pipe' });
```
skills/obsidian-to-x/scripts/paste-from-clipboard.ts:77 · shell_exec
Spawns a subprocess.
```
const result = spawnSync('osascript', ['-e', script], { stdio: 'pipe' });
```
skills/obsidian-to-x/scripts/paste-from-clipboard.ts:103 · shell_exec
Spawns a subprocess.
```
const which = spawnSync('which', [tool.cmd], { stdio: 'pipe' });
```
skills/obsidian-to-x/scripts/paste-from-clipboard.ts:107 · shell_exec
Spawns a subprocess.
```
const result = spawnSync(tool.cmd, tool.args, { stdio: 'pipe' });
```

skills/obsidian-to-x/scripts/paste-from-clipboard.ts:130 · shell_exec

Spawns a subprocess.

const result = spawnSync('powershell.exe', ['-NoProfile', '-Command', ps], { stdio: 'pipe' });

skills/obsidian-to-x/scripts/md-to-post.ts:37 · shell_exec
Spawns a subprocess.
```
const curl = spawn('curl', ['-s', '-L', '-o', outputPath, url]);
```
skills/obsidian-to-x/scripts/check-paste-permissions.ts:69 · shell_exec
Spawns a subprocess.
```
const result = spawnSync('osascript', ['-e', `
```
+ 20 more

Medium9

skills/obsidian-to-x/scripts/check-paste-permissions.ts:116 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(genScript, swiftSrc, 'utf8');
```
skills/obsidian-to-x/scripts/check-paste-permissions.ts:137 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(clipScript, clipSrc, 'utf8');
```
skills/obsidian-to-x/scripts/copy-to-clipboard.ts:192 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(swiftPath, getMacSwiftClipboardSource(), 'utf8');
```
skills/obsidian-to-x/scripts/copy-to-clipboard.ts:200 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(swiftPath, getMacSwiftClipboardSource(), 'utf8');
```
skills/obsidian-to-x/scripts/copy-to-clipboard.ts:348 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(htmlPath, html, 'utf8');
```
skills/obsidian-to-x/scripts/x-utils.ts:352 · obfuscated
atob() called on a variable — possible runtime decoding.
```
const binary = atob(base64);
```
skills/obsidian-to-x/scripts/md-to-article.ts:138 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
const file = fs.createWriteStream(destPath);
```
skills/obsidian-to-x/scripts/md-to-article.ts:598 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(saveHtmlPath, result.html, 'utf-8');
```
+ 1 more

Low1

skills/obsidian-to-x/scripts/x-utils.ts:354 · obfuscated
charCodeAt in a loop — possible string-decoding routine.
```
for (let i = 0; i < binary.length; i++) {
```

Verified by Novingly

Fix the findings. Earn the badge.

Skills scoring 90+ qualify for the Verified badge — a signed, embeddable trust signal for your README. Your score has room to move. We offer a done-for-you audit that files PRs directly against your repo.

View pricing→Request a DFY audit →