create-skill
Warn
Audited by Socket on Nov 10, 2026
1 alert found:
SecuritySecurityscripts/bundle_skill.py
MEDIUMSecurityMEDIUM
scripts/bundle_skill.py
The fragment is a resource-bundling and reference-rewriting utility, but the supplied code is syntactically invalid because unquoted prose appears in the body of _skip_remedy, preventing execution. Its intended behavior includes filesystem writes and read-only git history queries; the GitHub URL is inserted into rewritten links and is not contacted. No credential theft, data exfiltration, or other malware behavior is evident; the main concern is code corruption that disables the utility, a high operational-integrity risk.
Confidence: 99%Severity: 72%
Audit Metadata