autoskill
What this skill does
autoskill is a tool for observing user screen activity, detecting research workflows, and proposing new skills or skill compositions based on observed patterns. It relies on the screenpipe daemon for
github/k-dense-ai - API Key Exposure - 33.1k stars
Threat analysis
Skill info
pkg:github/K-Dense-AI/scientific-agent-skills@3956e54?skill=autoskillAssessments (2)
API Key Exposure
API Key Exposure via local-llm-review
scripts/doctor.py
default_llm_probe function checks for ANTHROPIC_API_KEY and FOUNDRY_API_KEY in the environment but does not validate or sanitize their usage. If these keys are used inappropriately, they could be expoData Exfiltration Risk
Data Exfiltration Risk via local-llm-review
scripts/backends.py
check_remote_endpoint function sends screen-derived summaries to a remote host over HTTP if not using HTTPS. This could expose sensitive data if the endpoint is not properly secured.Badge
Add the Anomity scan badge for autoskill to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of autoskill? Report an issue or request a rescan.
