mareasw/ontoskills

Score 4. Found 3 critical, 3 medium findings.

https://github.com/mareasw/ontoskillsScanned April 29, 2026 at 12:16 PM

Scan another skill →

Trust score

4/ 100

Score 4. Found 3 critical, 3 medium findings.

mareasw/ontoskills · 50 of 268 files read

Critical3

cli/lib/paths.js:103 · shell_exec

Spawns a subprocess.

const result = spawnSync(command, ["--help"], { stdio: "ignore" });

cli/lib/paths.js:108 · shell_exec

Spawns a subprocess.

return spawnSync(command, args, { stdio: "pipe", encoding: "utf-8", ...options });

cli/lib/paths.js:112 · shell_exec

Spawns a subprocess.

const result = spawnSync(command, args, { stdio: "pipe", encoding: "utf-8", ...options });

Medium3

cli/lib/paths.js:79 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
```
cli/lib/registry.js:165 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(ENABLED_INDEX_PATH, ttlImports([...enabled].sort()), "utf-8");
```
cli/lib/registry.js:258 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(destination, buffer);
```

Verified by Novingly

Fix the findings. Earn the badge.

Skills scoring 90+ qualify for the Verified badge — a signed, embeddable trust signal for your README. Your score has room to move. We offer a done-for-you audit that files PRs directly against your repo.

View pricing→Request a DFY audit →