agentic-development
Audited by Socket on Mar 18, 2026
1 alert found:
SecurityThis skill is instructional and does not contain obfuscated or clearly malicious code. However, it exposes high-risk capabilities (reading arbitrary absolute file paths, writing arbitrary files, executing shell commands, and sending tool results to remote LLM/APIs). Those capabilities are consistent with a code-modification / agenting tool but require strict guardrails, path/scope restrictions, and runtime enforcement to prevent accidental credential/data exfiltration. No hardcoded secrets, obfuscated payloads, or remote code-download mechanisms are present in the supplied content. Recommendation: treat this skill as potentially risky if run with broad privileges — enforce sandboxing (restrict allowed paths, disallow arbitrary command execution, require explicit human approvals), validate network endpoints against allowlists, and avoid sending sensitive files to external LLMs unless explicitly approved.