skills/bytedance/deer-flow/skill-reviewer/Socket

skill-reviewer

Warn

Audited by Socket on Jul 12, 2026

1 alert found:

Security

Securityevals/fixtures/prompt-injection/SKILL.md

MEDIUM

SecurityMEDIUM

evals/fixtures/prompt-injection/SKILL.md

SUSPICIOUS: the stated purpose is calibration, but the skill embeds active prompt-injection instructions plus shell execution and outbound data collection behavior. Even as a test artifact, its actual footprint is disproportionate to the purpose and would expose secrets if followed.

Confidence: 96%Severity: 86%

Audit Metadata

Analyzed At

Jul 12, 2026, 12:58 PM

Package URL

pkg:socket/skills-sh/bytedance%2Fdeer-flow%2Fskill-reviewer%2F@5567df26093bc627afc6f63d01671bac90ce09ff178ff9d88038e9318a22e4f0