remote-run
Warn
Audited by Socket on Sep 12, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: mostly coherent BuildBuddy remote-execution workflow with official same-org install/docs, but the skill expands scope by enabling arbitrary remote shell commands, uploads local git diffs off-host, and relies on a pipe-to-shell installer plus credential forwarding to an external CLI/service. This looks like a legitimate but medium-risk remote execution skill, not confirmed malware.
Confidence: 91%Severity: 56%
Audit Metadata