Evol-ai/SkillCompass

Score 0. Found 12 critical, 22 high, 22 medium findings.

https://github.com/Evol-ai/SkillCompassScanned April 29, 2026 at 12:19 PM

Scan another skill →

Trust score

0/ 100

Score 0. Found 12 critical, 22 high, 22 medium findings.

Evol-ai/SkillCompass · 50 of 127 files read

Critical12

lib/git-skill-reader.js:5 · shell_exec
Imports Node child_process — can spawn arbitrary commands.
```
* timestamp, local SKILL.md version extraction. No child_process, no
```

lib/update-checker.js:66 · shell_exec

Spawns a subprocess.

execSync('git fetch', { cwd: skillPath, timeout: 30000, stdio: 'pipe' });

lib/update-checker.js:70 · shell_exec

Spawns a subprocess.

const status = execSync('git status -sb', { cwd: skillPath, timeout: 5000, encoding: 'utf-8' });

lib/update-checker.js:78 · shell_exec

Spawns a subprocess.

currentRef = execSync('git log --oneline -1 HEAD', { cwd: skillPath, timeout: 5000, encoding: 'utf-8' }).trim();

lib/update-checker.js:79 · shell_exec

Spawns a subprocess.

remoteRef = execSync('git log --oneline -1 FETCH_HEAD', { cwd: skillPath, timeout: 5000, encoding: 'utf-8' }).trim();

lib/update-checker.js:123 · shell_exec
Spawns a subprocess.
```
execSync('git diff --quiet HEAD', {
```
lib/update-checker.js:144 · shell_exec
Spawns a subprocess.
```
const output = execSync('git pull --ff-only', {
```

lib/update-checker.js:157 · shell_exec

Spawns a subprocess.

return execSync('git remote get-url origin', { cwd: skillPath, timeout: 5000, encoding: 'utf-8' }).trim();

+ 4 more

High22

lib/quick-scan.js:188 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(this.cacheFile, JSON.stringify(data, null, 2), 'utf-8');
```
lib/audit-chain.js:68 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.appendFileSync(this.auditFile, JSON.stringify(entry) + '\n');
```
lib/usage-reader.js:194 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(this.usageFile, kept.join('\n') + '\n', 'utf-8');
```
lib/integrity-monitor.js:77 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(this.checksumsFile, JSON.stringify(checksumsData, null, 2));
```
lib/inbox-store.js:74 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(this.inboxFile, JSON.stringify(data, null, 2), 'utf-8');
```
hooks/scripts/write-last-version.js:22 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(versionFile, pkg.version);
```
scripts/eval-v2/download-skills.sh:126 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
require('fs').writeFileSync('$skill_dir/meta.json',JSON.stringify(meta,null,2));
```
hooks/scripts/session-tracker.js:35 · skill_mismatch
SKILL.md claims read-only behavior, but code performs filesystem writes.
```
fs.writeFileSync(sessionFile, sessionId, 'utf-8');
```
+ 14 more

Medium22

lib/quick-scan.js:188 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(this.cacheFile, JSON.stringify(data, null, 2), 'utf-8');
```
lib/audit-chain.js:68 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.appendFileSync(this.auditFile, JSON.stringify(entry) + '\n');
```
lib/usage-reader.js:194 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(this.usageFile, kept.join('\n') + '\n', 'utf-8');
```
lib/integrity-monitor.js:77 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(this.checksumsFile, JSON.stringify(checksumsData, null, 2));
```
lib/inbox-store.js:74 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(this.inboxFile, JSON.stringify(data, null, 2), 'utf-8');
```
hooks/scripts/write-last-version.js:22 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(versionFile, pkg.version);
```
scripts/eval-v2/download-skills.sh:126 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
require('fs').writeFileSync('$skill_dir/meta.json',JSON.stringify(meta,null,2));
```
hooks/scripts/session-tracker.js:35 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
fs.writeFileSync(sessionFile, sessionId, 'utf-8');
```
+ 14 more

Verified by Novingly

Fix the findings. Earn the badge.

Skills scoring 90+ qualify for the Verified badge — a signed, embeddable trust signal for your README. Your score has room to move. We offer a done-for-you audit that files PRs directly against your repo.

View pricing→Request a DFY audit →