security

55 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By notque/vexjoy-agent (GitHub) · coding · 449 stars · scanned at commit 1f3eabd

Works with any agent that supports SKILL.md skills.

Partially scanned — some files couldn't be read; we'll retry on the next scan

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a coding skill.

Found in 3 places.

skills/review/security/references/coverage.md, line 201. **Command injection** — user input reaching `exec.Command("sh","-c",...)`, `os.system`, `subprocess(..., shell=True)`, backticks. Fix: argv list, no shell; v
skills/review/security/references/coverage.md, line 125| **Python** | `pickle`/`yaml.load`/`torch.load` deserialization; stdlib XML → use `defusedxml`; `os.system`/`subprocess(shell=True)`; `bool("false")` coercion;
skills/review/security/references/coverage.md, line 126| **JS/TS** | `child_process.exec`/`execSync`; `new Function`; `.innerHTML`/`dangerouslySetInnerHTML`/`insertAdjacentHTML`; `crypto.createCipher`; `rejectUnauth

Connects to the internet

The author does not mention this.

Found in 2 places.

skills/review/security/references/coverage.md, line 223. **Argument injection (argv flag smuggling)** — a value starting with `-` becomes a flag even with no shell (`rg --pre=`, `git --upload-pack=`, `tar --checkpo
skills/review/security/references/coverage.md, line 4518. **SSRF** — user-influenceable URL/host reaching `requests`/`httpx`/`fetch`/`axios`/`http.Get`, OAuth/OIDC discovery fields, webhooks, storage clients. Taint

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this.

Found in 2 places.

skills/review/security/references/threat-model.md, line 64["Read(~/.ssh/**)", "Read(~/.aws/**)", "Read(**/.env*)",
skills/review/security/references/threat-model.md, line 65"Write(~/.ssh/**)", "Write(~/.aws/**)",

Downloads and installs other software

The author does not mention this.

Found in 1 place.

skills/review/security/references/threat-model.md, line 66"Bash(curl * | bash)", "Bash(ssh *)", "Bash(scp *)", "Bash(nc *)",

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'security' ] || [ -L ~/.agents/skills/'security' ]; then echo 'A skill folder named security already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/notque/vexjoy-agent' "$d" && git -C "$d" checkout --quiet '1f3eabdc4588b7136c37458758a583fc06464b09' -- 'skills/review/security' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/review/security' ~/.agents/skills/'security' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security' ~/.claude/skills/'security' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for notque/vexjoy-agent shows the score of its lowest-scoring skill.

SkillTrust badge for notque/vexjoy-agent

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/notque/vexjoy-agent.svg)](https://zalavijaysinh.github.io/skilltrust/repos/notque/vexjoy-agent/)

Score history

Date	Version	Score
2026-11-13	`1f3eabd`	55
2026-11-09	`1f7428e`	90
2026-11-07	`da9ae47`	59