restricted-bigquery-dbt-environment

Fail

Audited by Socket on Feb 17, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

[Skill Scanner] Installation of third-party script detected The code fragment is aligned with a safe development workflow to prevent accidental writes to production by directing models to a test schema and validating via compilation, with explicit safeguards (user confirmation, git-diff cleanup). The main concern is quality and reliability: typos and ambiguous command syntax (e.g., 'uv' prefix) could hinder automated tooling and confuse developers. If cleaned, the footprint is benign and proportionate to the stated purpose. LLM verification: The document is a safety-oriented developer instruction to reduce accidental production writes by using schema='test'. The file itself contains no embedded malware or secrets, but it instructs execution of potentially risky operations: unpinned pip installs and running dbt (which uses local BigQuery credentials). Main recommendations: pin dependency versions in pyproject.toml or install from a lockfile; verify and document what the 'uv' wrapper is or avoid unknown wrappers; implement automated g

Confidence: 95%Severity: 90%
Audit Metadata
Analyzed At
Feb 17, 2026, 02:57 PM
Package URL
pkg:socket/skills-sh/i9wa4%2Fdotfiles%2Frestricted-bigquery-dbt-environment%2F@08c2d3adfdf403e7503286107149d570cb60063c