audit-website
Audited by Socket on Feb 21, 2026
1 alert found:
Malware[Skill Scanner] Pipe-to-shell or eval pattern detected All findings: [CRITICAL] command_injection: Pipe-to-shell or eval pattern detected (CI013) [AITech 9.1.4] [CRITICAL] command_injection: URL pointing to executable file detected (CI010) [AITech 9.1.4] [CRITICAL] command_injection: Pipe-to-shell or eval pattern detected (CI013) [AITech 9.1.4] [HIGH] command_injection: Backtick command substitution detected (CI003) [AITech 9.1.4] Report 2 presents a coherent and practical overview of auditing websites with squirrelscan, but it relies on high-risk remote installation patterns (curl | bash and PowerShell IEX) without safe, verifiable distribution mechanisms. To reduce supply-chain risk, adopt signed releases with pinned hashes or trusted package managers and add explicit integrity verification steps. The core auditing workflow (crawl → analyze → report) is sound, and overall security risk remains moderate but avoidable with safer installation practices. LLM verification: The skill's documentation describes a legitimate website-auditing capability but contains multiple high-risk operational patterns: download-and-execute installer instructions (curl|bash, PowerShell remote-execute), instructions to discover local environment and internal resources, and strong encouragement of autonomous, no-confirmation bulk edits via spawned subagents. I assess this as not demonstrably malicious in the provided file, but as a medium-high supply-chain and operational risk. Recomm