Security Audit

jimliu/baoyu-skills:skills/baoyu-danger-x-to-markdown

github.com/jimliu/baoyu-skills

AI SkillCommit 6b7a2e417500

CAUTION

Scanned 24 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

jimliu/baoyu-skills:skills/baoyu-danger-x-to-markdown received a trust score of 68/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.

SkillShield's automated analysis identified 4 findings: 0 critical, 1 high, 2 medium, and 1 low severity. Key findings include Hardcoded Bearer Token detected, Sensitive environment variable access: $HOME, Unpinned npm dependency version.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on August 6, 2026 (commit 6b7a2e41). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

78%

Dependency Graph

91%

LLM Behavioral Safety

100%

Behavioral Risk Signals

Filesystem Write

1 finding

Shell Execution

1 finding

Excessive Permissions

1 finding

Security Findings4

Severity	Finding	Layer	Location
HIGH	Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference.	Static	skills/baoyu-danger-x-to-markdown/scripts/constants.ts:4
MEDIUM	Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated.	Static	skills/baoyu-danger-x-to-markdown/SKILL.md:84
MEDIUM	Unpinned npm dependency version Dependency 'baoyu-chrome-cdp' is not pinned to an exact version ('^0.1.1'). Pin dependencies to exact versions to reduce drift and supply-chain risk.	Dependencies	skills/baoyu-danger-x-to-markdown/scripts/package.json
LOW	Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution.	Dependencies	skills/baoyu-danger-x-to-markdown/scripts/package.json

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/92f207a930886ca3.svg)](https://skillshield.io/report/92f207a930886ca3)