Synk detect caveman skill as a high security risk
Author: kawpiiCreated Aug 18, 2026Updated Sep 15, 2026
Labelsbug
What happen Synk identify Caveman as a high security risk.
Following are the results when scanned with Snyk Agent Scan v0.5.16. You can run the scan by installing https://github.com/snyk/agent-scan OR uploading skill files here.
├── caveman 1 high finding
│ ● [W007 high]: Insecure credential handling detected (high risk: 1.00). The prompt requires preserving code blocks, CLI commands, API names
│ and "exact error strings" verbatim and to "fire direct" tool calls, which would force the model to echo any secrets or credentials present in
│ user input or commands back into outputs or requests.
│ ├── instruction SKILL.md
│ └── instruction README.md
├── caveman-stats
│ ├── instruction SKILL.md
│ └── instruction README.md
├── gh
│ └── instruction SKILL.md
├── caveman-help
│ ├── instruction SKILL.md
│ └── instruction README.md
├── caveman-commit
│ ├── instruction SKILL.md
│ └── instruction README.md
├── caveman-compress 1 high finding
│ ● [W007 high]: Insecure credential handling detected (high risk: 1.00). The skill tells the agent to call Claude to compress files while
│ explicitly requiring that code blocks, inline code, commands, URLs, file paths and environment variables be preserved EXACTLY, which would
│ force the model to reproduce any embedded secrets (API keys, tokens, passwords) verbatim in its output.
│ ├── instruction SKILL.md
│ ├── instruction SECURITY.md
│ ├── instruction README.md
│ ├── script scripts/compress.py
│ ├── script scripts/validate.py
│ ├── script scripts/__init__.py
│ ├── script scripts/cli.py
│ ├── script scripts/__main__.py
│ ├── script scripts/benchmark.py
│ └── script scripts/detect.py
├── cavecrew
│ ├── instruction SKILL.md
│ └── instruction README.md
├── caveman-review
│ ├── instruction SKILL.md
│ └── instruction README.md
Expected No security risk.
Before/after example NA
Platform NA
Version / install method Recent versions / npm
Source: JuliusBrussee/caveman