nexus-mapper

github.com/haaaiawd/nexus-skills
Verdict: Generally safe
0 critical1 high1 medium
B
SCORE 75 / 100
$skillox install nexus-mapperSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade B?

score · 75 / 100

The current grade reflects 1 high-severity finding (any HIGH → B).

0 CRIT1 HIGH1 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve all 1 HIGH.

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-exjm5taqnuywajibshau00a6 · Thu, 28 May 2026 17:48:06 GMT · 5ms

high
Obfuscation pattern: base64 blob
The skill contains an obfuscated payload pattern. Legitimate skills rarely include long base64/hex/unicode-escaped runs; review the content carefully.
rule: obfuscationline: 47CWE-506
▾
45```
46
47**语言支持**：自动按文件扩展名 dispatch，语言配置（扩展名映射 + Tree-sitter 查询）存储在 `scripts/languages.json`。当前已接入 Python/JavaScript/TypeScript/TSX/Bash/Java/Go/Rust/C#/C/C++/Kotlin/Ruby/Swift/Scala/PHP/Lua/Elixir/GDScript/Dart/Haskell/Clojure/SQL/Proto/Solidity/Vue/Svelte/R/Perl 等 30+ 语言。← base64 blob — review for hidden payload
48
49**非标准语言**：若仓库含有内置未支持的语言，通过命令行参数动态补充（详见 `references/05-language-customization.md`）：
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/nexus-mapper