The Agent Skills Directory

================================================================================

🟡 VERDICT: MEDIUM

This skill's primary function is to execute an external Datadog CLI. The CLI is sourced from leonardocouy/datadog-cli (GitHub) and executed via npx @leoflores/datadog-cli (npm). Neither leonardocouy nor leoflores are listed as trusted organizations or repositories. This means the actual code being executed by the skill cannot be verified by this analysis, posing a significant supply chain risk. If the external CLI were malicious, it could perform arbitrary actions on the system.

The skill also instructs the user to set DD_API_KEY and DD_APP_KEY as environment variables. While this is a standard practice for CLI tools, it means sensitive API keys are exposed to the unverified external process, increasing the potential impact if the CLI is compromised.

Total Findings: 3

🟡 MEDIUM Findings: • Unverifiable Dependencies

README.md, Line 10: The skill instructs to install a CLI from https://github.com/leonardocouy/datadog-cli, which is not a trusted source. The skill then executes this CLI via npx @leoflores/datadog-cli (SKILL.md, Line 20), which is also an untrusted external dependency from npm. This introduces a supply chain risk as the executed code cannot be verified. • Command Execution
SKILL.md, Line 20: The skill's core functionality involves executing npx @leoflores/datadog-cli <command>. While this is the intended behavior, the execution of an external, unverified binary means there is a risk of arbitrary command execution if the datadog-cli itself is compromised.

🔵 LOW Findings: • Credentials Unsafe

README.md, Line 17: The skill instructs the user to set DD_API_KEY and DD_APP_KEY as environment variables. While this is a common method for providing credentials to CLI tools, it means sensitive API keys are made available to the unverified external datadog-cli process. The risk is primarily dependent on the trustworthiness of the external CLI.

================================================================================