sponsor-finder

Warn

Audited by Runlayer on Feb 22, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
1
Flagged
1
Chunks
2
Flagged Files (1)
SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/2] Description: --- name: sponsor-finder description: Find which of a GitHub repository's dependencies are sponsorable via GitHub Sponsors. Uses deps.dev API for dependency resolution across npm, PyPI, Cargo, Go, RubyGems, Maven, and NuGet. Checks npm funding metadata, FUNDING.yml files, and web search.

Tool: SKILL.md [2/2] Description: a time**. --- ## Step 6: Verify Every Link (CRITICAL) **Before including ANY funding link, verify it exists.** Use `web_fetch` on each funding URL: - **Valid page** → ✅ Include - **404 / "not found" / "not enrolled"** → ❌ Exclude - **Redirect to valid page** → ✅ Include final URL Verify in batches of **5 at a time**. Never present unverified links.

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
1
Files Flagged
1
Chunks Analyzed
2
Analyzed
Feb 22, 2026, 03:00 AM
Security Audit — runlayer — sponsor-finder