command-development
Warn
Audited by Socket on Sep 14, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the stated purpose is harmless documentation, but the skill body includes numerous live pre-execution directives that would run commands at load time, some with user-controlled arguments and plugin-script execution. Data does not route to obvious attacker endpoints, so this is not confirmed malware, but the skill is high risk and internally inconsistent because a guide should not itself execute commands.
Confidence: 95%Severity: 91%
Audit Metadata