uv-skill

Fail

Audited by Socket on Feb 15, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

This SKILL.md-like documentation is consistent with its claimed purpose (guiding use of 'uv'). It contains no embedded obfuscated code, hardcoded secrets, or explicit exfiltration. The main security concern is the recommended installer pattern that executes remote scripts directly (curl | sh, PowerShell iex), which is a high-risk convenience pattern but common in installer docs. Overall the artifact appears benign as documentation, but users should review any installer scripts before executing and trust the listed download sources and indexes.

Confidence: 80%Severity: 15%
Audit Metadata
Analyzed At
Feb 15, 2026, 08:56 PM
Package URL
pkg:socket/skills-sh/julianobarbosa%2Fclaude-code-skills%2Fuv-skill%2F@1a54b083143595e01160e8961d1643a5174a96c5