guidance

Warn

Audited by Socket on Oct 1, 2026

1 alert found:

Security
SecurityMEDIUM
references/common-patterns.md

The examples do not show clear malware or obfuscation. The ReAct calculator is unsafe because it evaluates model-generated text as Python, creating an arbitrary-code-execution risk when the example runs. Avoid eval and use a restricted arithmetic parser or other narrowly scoped calculator implementation. Do not send sensitive prompt data to an external model unless permitted.

Confidence: 99%Severity: 78%
Audit Metadata
Analyzed At
Oct 1, 2026, 07:52 AM
Package URL
pkg:socket/skills-sh/kalarislabs%2Fresearch-agent-skills%2Fguidance%2F@5af5af064fdc13d8d974be3d774688651c6188ad9ff8b9c78f7a47eaec870bf8
Security Audit — socket — guidance