langchain4j-tool-function-calling-patterns

Fail

Audited by Socket on Feb 23, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

[Skill Scanner] Instruction directing agent to run/execute external content This SKILL.md is documentation and example code for LangChain4j tool/function calling patterns. There is no direct malicious code or obvious supply-chain exploit in the provided material. The main risks are operational: examples include tools that perform database writes and external network calls, dynamic tool provisioning, and metadata that allows powerful agent capabilities (Bash, Read, Write). If those runtime capabilities are granted without strict permissioning, input validation, secrets management, and audit controls, the environment could be abused. Recommend: enforce least-privilege agent tool permissions, validate and authorize all tool calls that have side effects, avoid exposing raw ToolMemoryId or secrets to the LLM, and carefully review any runtime-registered executors. LLM verification: This SKILL.md is documentation for LangChain4j tool/function calling patterns and contains example code that legitimately demonstrates how to define and register tools, call external services, and perform stateful actions. There is no embedded malicious code or obvious supply-chain download/execution commands. However, the examples include operations with side effects (database writes, preference changes) and integration with external APIs and user memory contexts without showing concrete author

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 23, 2026, 11:40 PM
Package URL
pkg:socket/skills-sh/giuseppe-trisciuoglio%2Fdeveloper-kit-claude-code%2Flangchain4j-tool-function-calling-patterns%2F@0a331a537532781daeb481ccf6e5900fd6d9ace8