agentic-development

Warn

Audited by Socket on Mar 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This skill is instructional and does not contain obfuscated or clearly malicious code. However, it exposes high-risk capabilities (reading arbitrary absolute file paths, writing arbitrary files, executing shell commands, and sending tool results to remote LLM/APIs). Those capabilities are consistent with a code-modification / agenting tool but require strict guardrails, path/scope restrictions, and runtime enforcement to prevent accidental credential/data exfiltration. No hardcoded secrets, obfuscated payloads, or remote code-download mechanisms are present in the supplied content. Recommendation: treat this skill as potentially risky if run with broad privileges — enforce sandboxing (restrict allowed paths, disallow arbitrary command execution, require explicit human approvals), validate network endpoints against allowlists, and avoid sending sensitive files to external LLMs unless explicitly approved.

Confidence: 80%Severity: 55%
Audit Metadata
Analyzed At
Mar 18, 2026, 04:50 PM
Package URL
pkg:socket/skills-sh/alinaqi%2Fclaude-bootstrap%2Fagentic-development%2F@69abf0f8fe16f78f506b130516508918bd8ff5f6