skill-snitch

84 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By SimHacker/moollm (GitHub) · security · 62 stars · scanned at commit 59e5336

Security auditing for MOOLLM skills - static analysis and runtime surveillance

Works with any agent that supports SKILL.md skills.

Partially scanned — some files couldn't be read; we'll retry on the next scan

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 2 places.

skills/skill-snitch/SCAN-METHODOLOGY.md, line 105DANGEROUS='(os\.system|subprocess\.(call|run|Popen)|eval\(|exec\(|__import__|pickle\.load|urllib\.request|requests\.(get|post)|fetch\(|child_process|new Functio
skills/skill-snitch/SKILL.md, line 442python3 skills/cursor-mirror/scripts/cursor_mirror.py deep-snitch --composer ID --yaml

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 4 places.

skills/skill-snitch/SCAN-METHODOLOGY.md, line 478- Any access to ~/.ssh, ~/.aws, .env, credentials?
skills/skill-snitch/SCAN-METHODOLOGY.md, line 509- ~/.ssh/config (SUSPICIOUS!)
skills/skill-snitch/SKILL.md, line 304- Any ~/.ssh, ~/.aws, .env, credentials access?

Show 1 more

skills/skill-snitch/SKILL.md, line 326- ~/.ssh/config (SUSPICIOUS!)

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 4 places.

skills/skill-snitch/SCAN-METHODOLOGY.md, line 481- Any WebSearch or WebFetch calls?
skills/skill-snitch/SKILL.md, line 271OBSERVED: tools: [read_file, write_file, Shell, WebSearch]
skills/skill-snitch/SKILL.md, line 272UNDECLARED: [Shell, WebSearch]

Show 1 more

skills/skill-snitch/SKILL.md, line 307- WebSearch, WebFetch, curl, wget?

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'skill-snitch' ] || [ -L ~/.agents/skills/'skill-snitch' ]; then echo 'A skill folder named skill-snitch already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/SimHacker/moollm' "$d" && git -C "$d" checkout --quiet '59e53364e95d818985fbea62f37627d4b59c9751' -- 'skills/skill-snitch' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/skill-snitch' ~/.agents/skills/'skill-snitch' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'skill-snitch' ~/.claude/skills/'skill-snitch' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for SimHacker/moollm shows the score of its lowest-scoring skill.

SkillTrust badge for SimHacker/moollm

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/SimHacker/moollm.svg)](https://zalavijaysinh.github.io/skilltrust/repos/SimHacker/moollm/)

Score history

Date	Version	Score
2026-11-08	`59e5336`	84