Dangerous: change-miniapp - llms-full.txt | Skillgate

Skillgate scanned try2/llms-full.txt in change-miniapp and rated it Dangerous with a risk score of 97/100 (9 detections).

Skillgate found one or more attack-shaped patterns - the kind used for credential exfiltration, remote code execution, or instruction hijack. Do not load this file into an agent without reading it end to end.

What was found

• SG-071 Hardcoded Provider Secret in Config - CRITICAL (2x): Hardcoded API keys / tokens / passwords / connection URIs in agent and MCP config files. Covers Supabase (sbp_, JWT), Postgres/MySQL/MongoDB/Redis URIs with embedded password, Tavily / Firecrawl / Brave / Context7 / ref-tools / TestSprite / OpenRouter branded keys, Pipedream MCP UUID endpoints, and JSON/env-line patterns where a sensitive-named key holds a high-entropy value.
• SG-029 Semantic Trojan - HIGH: Malicious side effects disguised as legitimate tasks, concealment directives, hidden instruction blocks
• SG-012 Suspicious URL - MEDIUM (2x): HTTP URLs, IP-address URLs, non-standard ports, URL shorteners
• SG-019 Environment Probing - MEDIUM: System enumeration commands: whoami, uname, env dump, process listing, cloud IMDS probes
• SG-022 Context Window Flooding - MEDIUM (2x): Repetitive filler text, context boundary spoofing, excessive separators
• SG-025 Backdoor Trigger Phrase - MEDIUM: Keyword triggers, password gates, staged execution, trust-building deception patterns

What to do

Read the flagged lines in the source file yourself before installing it or letting an agent load it. Every detection above links to the rule that fired, with the conditions that trigger it and remediation where one exists. Open the interactive report for evidence lines and context.

About Skillgate

Skillgate is a free scanner from Mitiga Labs for AI agent skills, hooks, MCP configs, and instruction files (SKILL.md, CLAUDE.md, AGENTS.md, .cursorrules, .claude/settings.json). It runs static rules plus an LLM judge and maps each finding to a known attack technique. Static analysis only: it never executes the file it scans. No scanner is 100% accurate - a verdict is a signal, not a guarantee. Browse all detection rules.