All 33 static detections are false positives caused by Markdown formatting, documented HTTPS endpoints, CLI names, placeholders, and relative documentation links. However, the skill requires following shared documents outside the audited package, creating an unreviewed instruction dependency that should be removed or pinned before publication.
The skill instructs the agent to read and follow two sibling shared documents before running commands. Those documents are outside the audited skill files, so their contents can change independently and introduce unsafe instructions.
The instruction explicitly requires following external sibling files, while the audited file structure does not include them. Their content and integrity cannot be evaluated in this audit.
Most backtick execution and system reconnaissance alerts are Markdown false positives. The hardcoded URLs are confirmed low-risk external network references, and the parent-directory setup references are confirmed high-risk unreviewed instruction dependencies. Additional review found operational risks around API key confirmation, secret output handling, and production cleanup limits.
The skill covers creating, updating, disabling, and permanently revoking Portal API keys. It warns that revoke is permanent, but it does not require explicit user confirmation before state-changing actions.
The command table and rules clearly describe state-changing credential operations. No reviewed line adds a confirmation gate before those operations.
The reference output includes a full API key field, and the skill notes that the full key is returned only once. Agents could expose real secrets if they relay command output verbatim into chat or logs.
The reviewed files explicitly show and describe full key output. The sample value appears synthetic, but the workflow handles real one-time secrets.
Production Backend Limitation Can Leave Keys Without Cleanup
The skill says single-key routes for get, update, and revoke are broken in production. Creating temporary production keys while revoke is unavailable can leave credentials active without a tested cleanup path.
Both files describe the broken production routes and explicitly warn against temporary production smoke keys without cleanup. The risk follows directly from the documented limitation.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs agents to read ../_shared/preflight.md, which crosses out of the skill directory. This can pull unreviewed instructions into the trusted workflow.
The skill instructs agents to read ../_shared/session-and-target.md, which crosses out of the skill directory. This can pull unreviewed instructions into the trusted workflow.
The reference command targets the production AltLLM Portal API at https://platform-api.altllm.ai. This is intended, but it causes external network requests for account and API key management.
The reference command targets the production AltLLM Portal API at https://platform-api.altllm.ai. This is intended, but it causes external network requests for account and API key management.