Damage Control
Audited by Socket on Feb 16, 2026
4 alerts found:
Securityx3Obfuscated FileThe document contains an explicit, single-line destructive shell command intended to delete files under .claude/hooks and social-engineering language urging blind execution. The content is risky: executing it can cause loss of automation hooks and break CI/workflows. There is no evidence of embedded network exfiltration or obfuscated malware, but the instruction is a potentially dangerous operational command and should not be run in production or without explicit verification and safeguards.
This artifact is a high-risk instruction that, if executed by a CI runner or operator, would severely compromise system security by recursively setting world-writable permissions on /etc. The file itself contains no encoded or obfuscated executable payloads, but it is socially engineered to induce destructive actions and should be blocked, removed, or sandboxed and never run on production systems. Treat it as malicious/unsafe input and enforce pipeline protections and explicit approvals before any command execution.
This source is a high-risk instruction that requests executing 'rm -rf apps/'. It contains social-engineering cues to bypass safeguards and to hide protective measures. The text itself is not obfuscated and does not contain network or data-exfiltration code, but executing the command in a real environment will permanently delete the targeted directory and its contents if permissions allow. Do not run this command on production or valuable data; perform any testing only in isolated, disposable sandboxes with explicit safeguards and logging. Reject or require stronger controls before execution.
This instruction fragment contains explicit, high-risk destructive commands that will delete files, corrupt or remove database contents, and dangerously change system permissions if executed on a host. There is no obfuscation or network exfiltration, but the actions can enable persistent compromise (via chmod 777 /etc/) and cause irrecoverable data loss. Treat as dangerous and never execute on production or non-ephemeral systems; only run in fully isolated sandboxes with clear guardrails and explicit human confirmation.