donut

Warn

Audited by Socket on Apr 16, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The skill is internally consistent with Donut’s real purpose and uses mostly official install sources, but that purpose is to help an AI agent generate shellcode and support injection/AMSI-bypass workflows. This makes it a high-risk offensive security capability rather than confirmed malware.

Confidence: 93%Severity: 90%
Audit Metadata
Analyzed At
Apr 16, 2026, 08:21 PM
Package URL
pkg:socket/skills-sh/AeonDave%2Fmalskill%2Fdonut%2F@cf84e115a1d0e55beb0dd6bce579e86d135c087c