Caveat verdict
1sec-security
An open-source Linux security platform skill with all external connections explicitly documented, opt-in only, and clearly purposeful (binary downloads from GitHub, optional cloud alerts, optional webhook notifications); no hidden data exfiltration.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
network_out
Findings (6)
Recursive delete from root or home — destructive command
SKILL.md · code · rm -rf ~
Possible hardcoded credential
references/config-reference.md · code · api_key: "your-cloud-api-key
References sudo — requests elevated privileges
SKILL.md · frontmatter · sudo
References webhook/callback URL
SKILL.md · frontmatter · WEBHOOK_URL
References agent memory files
references/vps-agent-guide.md · prose · downgraded · MEMORY.md
Popular HTTP library — network access
scripts/install-and-configure.sh · prose · downgraded · Got
Permissions & capabilities
No declared permissions — minimal attack surface.
network_outnetwork_in Is this flag fair?
Thanks — recorded.