skill-creator

Fail

Audited by Socket on Feb 24, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

[Skill Scanner] Instruction to copy/paste content into terminal detected The provided SKILL.md is a documentation/instruction file for creating and iterating on AI agent skills. It contains no direct malicious code, no remote-download or pipe-to-shell patterns, and its capabilities align with its stated purpose. The primary residual supply-chain risk is that it references local scripts and subagent tooling whose contents and runtime permissions are not included here — those scripts could perform harmful actions if malicious. Overall this document itself appears benign, but real-world use requires reviewing the implementation of the referenced scripts and ensuring subagents/tools have constrained permissions. LLM verification: The SKILL.md is a benign, well-documented coordinator for skill creation, testing, and iteration. It does not itself contain obfuscated code, hard-coded credentials, or explicit networking/exfiltration commands. The primary risk is operational/supply-chain: the document references and instructs running local helper scripts and subagents that are not included in the file. If those external scripts or subagent implementations are untrusted or tampered with, they could perform arbitrary filesystem

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 24, 2026, 05:19 AM
Package URL
pkg:socket/skills-sh/CaldiaWorks%2Fcaldiaworks-marketplace%2Fskill-creator%2F@360bdaa0b96309517526eb0ea554972fde4924fd