create-skill

Warn

Audited by Socket on Nov 10, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/bundle_skill.py

The fragment is a resource-bundling and reference-rewriting utility, but the supplied code is syntactically invalid because unquoted prose appears in the body of _skip_remedy, preventing execution. Its intended behavior includes filesystem writes and read-only git history queries; the GitHub URL is inserted into rewritten links and is not contacted. No credential theft, data exfiltration, or other malware behavior is evident; the main concern is code corruption that disables the utility, a high operational-integrity risk.

Confidence: 99%Severity: 72%
Audit Metadata
Analyzed At
Nov 10, 2026, 03:30 PM
Package URL
pkg:socket/skills-sh/gamaroff%2Fagent-skills%2Fcreate-skill%2F@86a84a9d28adbe69497326223039dff0229e1d646802aa8899ba710cf8f8aade