All 40 command findings are false positives caused by Markdown backticks, code fences, model names, and documented slash-command examples. Hidden configuration storage and token-validation prose are contextual, not hidden execution or reconnaissance. However, inline secret arguments and reusable subscription session tokens create credible credential exposure and account-security risks.
Consumer Session Tokens Used as Provider Credentials
The skill treats subscription session tokens as reusable provider credentials. This can expose accounts and bypass provider-approved OAuth or API boundaries.
Subscription authentication and session-token setup are explicit, but provider policy compliance cannot be verified from the documentation.
Most static command findings are false positives caused by Markdown inline code and fenced command examples, not executable Ruby or shell code. The remaining risk is sensitive credential handling because the skill stores provider credentials and OAuth tokens under a hidden home directory. No prompt injection language was found in SKILL.md.
The skill instructs users to provide API keys, subscription tokens, and OAuth credentials, then stores credentials and OAuth tokens under a hidden home directory. This creates secret exposure risk unless secure storage, redaction, rotation, and deletion are implemented.
Multiple documented workflows ask for provider secrets and the configuration block names files for stored credentials and tokens. The file does not include implementation evidence for encryption, keychain storage, or token redaction.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The path names a hidden home directory used for provider configuration. Surrounding lines describe auth.json and tokens.json storing credentials and OAuth tokens, which is sensitive local secret storage.
The documented hidden directory contains auth.json and tokens.json for provider credentials. Access to those files could expose API keys, OAuth tokens, or subscription tokens.
Most static external-command findings are false positives caused by Markdown inline code and fenced slash-command examples. The security-relevant issues are the documented hidden home-directory credential store and the skill flow that asks users to provide API keys, session tokens, and OAuth secrets.
The skill instructs users to provide API keys, subscription session tokens, OAuth client credentials, and local token storage. This is expected for provider management, but it requires strong storage controls and clear user consent.
Multiple command examples and the configuration section explicitly mention API keys, session tokens, client credentials, auth.json, and tokens.json. I found no evidence of exfiltration or prompt injection, so the finding is medium severity.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md directs configuration under ~/.opencode/provider-fallback/ and lists auth.json and tokens.json for credentials. A community skill that stores secrets in a hidden home directory is a real sensitive filesystem risk even when documented.
The documented hidden directory is intended for persistent provider configuration and credential storage. Hidden file access is legitimate for app config, but security relevant because it includes auth and OAuth token files.
Most static external-command findings are false positives caused by Markdown inline code and fenced slash-command examples. The security-relevant issues are the documented hidden home-directory credential store and the skill flow that asks users to provide API keys, session tokens, and OAuth secrets.
The skill instructs users to provide API keys, subscription session tokens, OAuth client credentials, and local token storage. This is expected for provider management, but it requires strong storage controls and clear user consent.
Multiple command examples and the configuration section explicitly mention API keys, session tokens, client credentials, auth.json, and tokens.json. I found no evidence of exfiltration or prompt injection, so the finding is medium severity.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
SKILL.md directs configuration under ~/.opencode/provider-fallback/ and lists auth.json and tokens.json for credentials. A community skill that stores secrets in a hidden home directory is a real sensitive filesystem risk even when documented.
The documented hidden directory is intended for persistent provider configuration and credential storage. Hidden file access is legitimate for app config, but security relevant because it includes auth and OAuth token files.
Static analysis reported many external command hits, but review shows these are Markdown inline code spans and fenced examples rather than executable scripts. The real risks are semantic: the skill documents command-line handling of API keys and session tokens, and it stores credentials and OAuth tokens under a hidden home-directory path without verifiable encryption.
Sensitive Provider Credentials Are Entered Through Commands
The documented setup flow passes API keys and subscription session tokens through slash-command arguments. This can expose secrets in chat transcripts, logs, command history, telemetry, or shared screenshots depending on the host environment.
The file explicitly shows API keys and session tokens supplied as command arguments. The exposure risk is clear, although the actual host logging behavior is not implemented in this skill file.
Needs review findings (1)
These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.
Local Credential And OAuth Token Storage Requires Stronger Guarantees
The skill documents auth.json and tokens.json under a hidden home-directory path and mentions file permissions, but no implementation is present to verify encryption, permission enforcement, token rotation, or safe deletion.
The documented storage of credentials and OAuth tokens is explicit. The severity is moderated because this repository shard contains documentation only and no code that writes the files.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static External Command Findings Are Markdown Examples
The repeated Ruby or shell backtick detections come from Markdown inline code spans and fenced bash examples for provider commands, model names, and provider IDs. No standalone script, shell invocation, or dynamic command construction is present in the scanned file.
Review of SKILL.md shows Markdown documentation and command examples, not executable code. The analyzer likely treated Markdown backticks as Ruby or shell backtick execution.
Weak Cryptography Detections Are Token And Model Text Matches
The weak cryptography blocker detections are not supported by evidence in the file. The flagged areas contain metadata, auth labels, model names, or credential examples, and no MD5, SHA1, DES, RC4, or custom cryptographic implementation appears in SKILL.md.
The cited lines do not contain weak cryptographic algorithms or crypto operations. The static result appears to be a keyword collision in prose or model/provider names.
System Reconnaissance Detection Is Troubleshooting Guidance
The system reconnaissance hit is tied to a troubleshooting sentence about ensuring a session token is valid. No host enumeration, environment discovery, or system information collection is described at the cited location.
The referenced lines only instruct users to replace an expired subscription token. There is no evidence of reconnaissance behavior in the scanned file.
This skill contains only documentation files (SKILL.md). No executable code exists. All 71 static findings are false positives triggered by markdown documentation syntax misinterpreted as code patterns.
This skill contains only documentation files (SKILL.md). No executable code exists. All 71 static findings are false positives triggered by markdown documentation syntax misinterpreted as code patterns.
Pure documentation-only skill. No code execution, no file system access, no network calls. SKILL.md contains only command documentation for a provider management system.
1
Files scanned
218
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation-only skill. No code execution, no file system access, no network calls. SKILL.md contains only command documentation for a provider management system.
1
Files scanned
218
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Pure documentation-only skill. No code execution, no file system access, no network calls. SKILL.md contains only command documentation for a provider management system.
1
Files scanned
218
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.