007

47 / 100 · High risk

Only if you trust the author. Some of what it can do is expected: a coding skill usually runs build and test commands.

By sinhoneyy/master-skills (GitHub) · coding · 17 stars · scanned at commit 8e70b78

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.

Found in 16 places.

skills/007/SKILL.md, line 139python C:\Users\renat\skills\007\scripts\surface_mapper.py --target <caminho>
skills/007/SKILL.md, line 181python C:\Users\renat\skills\007\scripts\threat_modeler.py --target <caminho> --framework stride
skills/007/SKILL.md, line 299python C:\Users\renat\skills\007\scripts\hardening_advisor.py --target <caminho> --level maximum

Show 13 more

skills/007/SKILL.md, line 333python C:\Users\renat\skills\007\scripts\score_calculator.py --target <caminho>
skills/007/SKILL.md, line 386- Novo codigo contendo `eval()`, `exec()`, `subprocess`, `os.system()`
skills/007/SKILL.md, line 570python C:\Users\renat\skills\007\scripts\quick_scan.py --target <caminho>
skills/007/references/owasp-checklists.md, line 14| **A03** | **Injection** | Untrusted data sent to interpreter without validation. SQL, NoSQL, OS command, LDAP injection. | String concatenation in queries: `f
skills/007/scripts/full_audit.py, line 247"Replace os.system(), os.popen(), and subprocess with shell=True "
skills/007/scripts/full_audit.py, line 248"with subprocess.run() using shell=False and a list of arguments. "
skills/007/scripts/scanners/dependency_scanner.py, line 131r"""(?:curl|wget|fetch|http|eval|exec|child_process|\.sh\b|powershell)""",
skills/007/scripts/scanners/injection_scanner.py, line 142For example, ``eval("1+1")`` or ``os.system("clear")`` with no variables.
skills/007/scripts/scanners/injection_scanner.py, line 265"subprocess with shell=True -- command injection risk if input is variable",
skills/007/scripts/scanners/injection_scanner.py, line 272"os.system() -- always uses a shell; prefer subprocess without shell=True",
skills/007/scripts/scanners/injection_scanner.py, line 279"os.popen() -- shell command execution",
skills/007/scripts/scanners/injection_scanner.py, line 283r"""\b(?:child_process\.exec|execSync|exec)\s*\(""",
skills/007/scripts/scanners/injection_scanner.py, line 286"child_process.exec() in Node.js -- uses shell by default",

Connects to the internet

The author does not mention this.

Found in 6 places.

skills/007/references/owasp-checklists.md, line 21| **A10** | **SSRF** | Server-side request forgery - application fetches attacker-controlled URL. | `fetch(user_provided_url)`; URL parameter for image processi
skills/007/scripts/scanners/injection_scanner.py, line 438"requests.get/post with potentially user-controlled URL",
skills/007/scripts/scanners/injection_scanner.py, line 442r"""\b(?:urllib\.request\.urlopen|urllib\.request\.Request|"""

Show 3 more

skills/007/scripts/scanners/injection_scanner.py, line 443r"""urllib2\.urlopen|urlopen)\s*\([^)]*(?:\bvar\b|\bdata\b|\brequest\b|"""
skills/007/scripts/scanners/injection_scanner.py, line 455"fetch() with potentially user-controlled URL",
skills/007/scripts/scanners/injection_scanner.py, line 463"axios with potentially user-controlled URL",

Reads your saved credentials, such as SSH keys or .env files

The author does not mention this.

Found in 1 place.

skills/007/references/stride-pasta-guide.md, line 364blocked_paths: ["~/.ssh", "~/.aws", ".env"]

Can call paid AI services billed to you

The author does not mention this.

Found in 1 place.

skills/007/references/stride-pasta-guide.md, line 382allowed_domains: ["api.openai.com", "api.anthropic.com"]

Downloads and installs other software

The author does not mention this.

Found in 2 places.

skills/007/scripts/scanners/dependency_scanner.py, line 291recommendation="Consider using --hash for supply chain integrity (pip install --require-hashes)",
skills/007/scripts/scanners/dependency_scanner.py, line 779description="Pipe-to-shell pattern detected (curl|bash). Remote code execution risk",

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

sinhoneyy/master-skills has 1 more folder with a skill named 007. This page shows the lowest-scoring copy.

plugins/master-skills-devops-cloud/skills/007 47/100 · High risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'007' ] || [ -L ~/.agents/skills/'007' ]; then echo 'A skill folder named 007 already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/sinhoneyy/master-skills' "$d" && git -C "$d" checkout --quiet '8e70b780359915a1f197ca37a1add2d4016115a2' -- 'skills/007' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/007' ~/.agents/skills/'007' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'007' ~/.claude/skills/'007' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for sinhoneyy/master-skills shows the score of its lowest-scoring skill.

SkillTrust badge for sinhoneyy/master-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/sinhoneyy/master-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/sinhoneyy/master-skills/)

Score history

Date	Version	Score
2026-11-09	`8e70b78`	47