Skill

testing-for-sensitive-data-exposure

skill:mukul975/anthropic-cybersecurity-skills#testing-for-sensitive-data-exposure

Identifying sensitive data exposure vulnerabilities including API key leakage, PII in responses, insecure storage, and unprotected data transmission during security assessments.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:19 UTC at 54a7988

findings

medium

highest severity

threat classes

4,532

files scanned

91/91

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:skills/testing-for-sensitive-data-exposure:skills/testing-for-sensitive-data-exposure/SKILL.md:54:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The skill's prerequisites instruct installing remote security tools at unpinned versions (gitleaks via @latest, trufflehog via unpinned pip), leaving the dependency supply chain unpinned even though the packages are official and the install docs are open.

skills/testing-for-sensitive-data-exposure/SKILL.md:54

go install github.com/gitleaks/gitleaks/v8@latest

vector:instruction

Counter-argument considered

The quote is accurate and sits in the agent-readable skill body: the prerequisites instruct unpinned remote installs (`go install ...@latest`, bare `pip install trufflehog`), which fall outside the pinned-official-registry carve-out, so the low-confidence contextual_risk supply finding is not contradicted by any evidence; the openness of the install docs (declared claim D2 repeats the command verbatim) is correctly acknowledged by the finding itself and does not clear the unpinned-registry harm.