← All skills
007
47 / 100 · High risk
Only if you trust the author. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By anubhavg-icpl/vibe (GitHub) · security · 13 stars · scanned at commit d51e7ac
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project. Use when you need help with 007.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 78 places.
Show 17 more
- skills/ag-007/SKILL.md, line 324
python C:\Users\renat\skills\007\scripts\score_calculator.py --target <caminho> - skills/ag-007/SKILL.md, line 377
- Novo codigo contendo `eval()`, `exec()`, `subprocess`, `os.system()` - skills/ag-007/SKILL.md, line 561
python C:\Users\renat\skills\007\scripts\quick_scan.py --target <caminho> - skills/ag-007/references/owasp-checklists.md, line 14
| **A03** | **Injection** | Untrusted data sent to interpreter without validation. SQL, NoSQL, OS command, LDAP injection. | String concatenation in queries: `f - skills/ag-007/scripts/full_audit.py, line 247
"Replace os.system(), os.popen(), and subprocess with shell=True " - skills/ag-007/scripts/full_audit.py, line 248
"with subprocess.run() using shell=False and a list of arguments. " - skills/ag-007/scripts/scanners/dependency_scanner.py, line 131
r"""(?:curl|wget|fetch|http|eval|exec|child_process|\.sh\b|powershell)""", - skills/ag-007/scripts/scanners/injection_scanner.py, line 142
For example, ``eval("1+1")`` or ``os.system("clear")`` with no variables. - skills/ag-007/scripts/scanners/injection_scanner.py, line 265
"subprocess with shell=True -- command injection risk if input is variable", - skills/ag-007/scripts/scanners/injection_scanner.py, line 272
"os.system() -- always uses a shell; prefer subprocess without shell=True", - skills/ag-007/scripts/scanners/injection_scanner.py, line 279
"os.popen() -- shell command execution", - skills/ag-007/scripts/scanners/injection_scanner.py, line 283
r"""\b(?:child_process\.exec|execSync|exec)\s*\(""", - skills/ag-007/scripts/scanners/injection_scanner.py, line 286
"child_process.exec() in Node.js -- uses shell by default", - .claude/settings.json, line 9
"command": "sh -c 'exec node \"${CLAUDE_PROJECT_DIR:-.}/.claude/helpers/hook-handler.cjs\" pre-bash'", - .claude/settings.json, line 19
"command": "sh -c 'exec node \"${CLAUDE_PROJECT_DIR:-.}/.claude/helpers/hook-handler.cjs\" pre-edit'", - .claude/settings.json, line 31
"command": "sh -c 'exec node \"${CLAUDE_PROJECT_DIR:-.}/.claude/helpers/hook-handler.cjs\" post-edit'", - .claude/settings.json, line 41
"command": "sh -c 'exec node \"${CLAUDE_PROJECT_DIR:-.}/.claude/helpers/hook-handler.cjs\" post-bash'",
and 58 more places
Connects to the internet
The author does not mention this. Expected for a security skill.
Found in 6 places.
Show 3 more
Reads your saved credentials, such as SSH keys or .env files
The author does not mention this. It runs automatically when the plugin is installed.
Found in 2 places.
Can call paid AI services billed to you
The author does not mention this.
Found in 1 place.
Downloads and installs other software
The author does not mention this. It runs automatically when the plugin is installed.
Found in 12 places.
Show 9 more
- .claude/settings.json, line 167
"Bash(npx claude-flow*)", - .mcp.json, line 4
"command": "npx", - hooks/cmods/README.md, line 96
npx eslint --fix "$FILE" 2>/dev/null - hooks/cmods/post-edit-format.sh, line 29
npx prettier --write "$FILE" 2>/dev/null && FORMATTED=true - hooks/cmods/post-edit-format.sh, line 32
npx biome format --write "$FILE" 2>/dev/null && FORMATTED=true - hooks/cmods/post-edit-format.sh, line 80
npx prettier --write "$FILE" 2>/dev/null && FORMATTED=true - hooks/cmods/post-edit-format.sh, line 86
npx prettier --write "$FILE" 2>/dev/null && FORMATTED=true - hooks/cmods/pre-commit-lint.sh, line 38
echo "$files" | xargs npx eslint --max-warnings 0 2>/dev/null - hooks/hooks.json, line 106
"command": "#!/bin/bash\n# Run TypeScript check after editing TS files\ninput=$(cat)\nfile_path=$(echo \"$input\" | jq -r '.tool_input.file_path // \"\"')\n\nif
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'007' ] || [ -L ~/.agents/skills/'007' ]; then echo 'A skill folder named 007 already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/anubhavg-icpl/vibe' "$d" && git -C "$d" checkout --quiet 'd51e7ac9a34111cd2e63daed83c2198f91570050' -- 'skills/ag-007' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/ag-007' ~/.agents/skills/'007' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'007' ~/.claude/skills/'007' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for anubhavg-icpl/vibe shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/anubhavg-icpl/vibe/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | d51e7ac | 47 |