claude-code-tips

[Skill Scanner] Installation of third-party script detected All findings: [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] [CRITICAL] command_injection: Installation of third-party script detected (SC006) [AITech 9.1.4] This SKILL.md appears benign and consistent: it reads a project-local index, conditionally performs web searches and fetches official/community pages, writes categorized markdown files, and returns cached or updated results. No hardcoded secrets, obfuscated code, or explicit exfiltration is present in the provided manifest. Primary security considerations are operational: ensure file writes are sandboxed (prevent path traversal or unintended overwrite of repository files) and audit the implementation of any nonstandard fetch tool (mcp__fetch__fetch). LLM verification: No explicit malicious code or backdoor is present in the SKILL.md content. The primary issues are security and operational hygiene: unpinned dependency examples, lack of source whitelisting and sanitization for scraped content, absence of robots/TOS and rate-limiting guidance, and broad filesystem write behavior which could persist sensitive or malicious content if the implementation is naive. Mitigations: pin dependencies, enforce trusted-source policies, sanitize and treat fetched content as u