deserialization-insecure — security audits

Flagged by auditors

Independent security partners scan this skill's files for malicious content, prompt injection and risky patterns. Verdicts below come from the skills.sh audit program; each partner links to its full report.

• Gen Agent Trust Hub

  fail

  This skill is a security research playbook for exploiting insecure deserialization vulnerabilities across Java, PHP, Python, .NET, and other languages. It contains numerous high-risk command execution templates and remote code execution payloads. An automated scanner flagged the referenced domain 'xxx.dnslog.cn' as malicious and identified 'SKILL.md' as suspicious due to the presence of exploitation-related HTTP request patterns. Additionally, the skill includes hardcoded default credentials for Apache Shiro.

  Risk: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSApr 30, 2026Full report

• Socket

  warn

  2 alerts: gptSecurity

  Apr 30, 2026Full report

• Snyk

  fail

  Risk: CRITICAL · 3 issues

  Risk: CRITICALApr 30, 2026Full report

• ZeroLeaks

  pass

  2 findings · Score: 80/100

  Risk: LOWApr 16, 2026Full report