Caveat verdict

axihub

axihub-subscription

88
🟢 Trusted
No high-risk patterns surfaced by the deep scan — automated capability review, not behavioral proof.

Content subscription network skill that stores content locally and communicates only with the declared axihub.net API using a user-provided key; the skill includes explicit security rules against sending the API key to other domains.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

60
security
80
transparency
90
maintenance

Findings (2)

Pattern match critical

Possible hardcoded credential

SETUP.md · code · API_KEY="axi_the_key_you_got

Pattern match medium

Possible prompt injection — attempts to redefine agent identity

SKILL.md · prose · downgraded · You are now

Why the tier is capped

Execution sink present in raw bytes (Hard Floor: class F). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.

Permissions & capabilities

No declared permissions — minimal attack surface.

credential_access

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API