moldea

Warn

Audited by Socket on Sep 28, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/managed-readme.mjs

The file is primarily a README maintenance utility, but its default managed block deliberately injects instructions aimed at steering AI agents toward a named skill and filesystem location. Treat this as a prompt-injection/supply-chain concern when repositories are consumed by AI tooling. No conventional credential theft, exfiltration, or system malware behavior is evident in the fragment.

Confidence: 98%Severity: 58%
Audit Metadata
Analyzed At
Sep 28, 2026, 01:58 AM
Package URL
pkg:socket/skills-sh/moldea-ai%2Fskill%2Fmoldea%2F@087903e7642528a6f33f2abe3c6f8a658341d06d0aa8ef03dd0a1a670c29a275
Security Audit — socket — moldea