create-agent-skills
Audited by Socket on Mar 11, 2026
1 alert found:
Obfuscated FileThe skill content is a meta-guide for creating Claude Code skills and slash commands. It presents a coherent purpose and a proportionate set of capabilities focused on documentation structure, invocation controls, and progressive disclosure. The primary security concern is the explicit use of dynamic shell execution (!`command`) before content is sent to Claude, which could be abused if misused in actual skills or if content sources are untrusted. Other potential risks are limited to design-time misconfigurations (collisions between skill and command names) rather than runtime threats. Overall, the footprint is benign to moderate with a single notable risk vector that should be guarded against in practice.