claude-plugin-converter

Warn

Audited by Socket on Oct 8, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/convert.py

The visible code is a plugin converter, not clearly malware. However, generated hooks can execute configured shell commands and transmit callback data to configured URLs, and skill paths from analysis data are not visibly confined to the plugin directory. Review source plugin configuration and analysis data before conversion or running generated output. The fragment is malformed/incomplete, so conclusions are limited to visible code.

Confidence: 90%Severity: 58%
Audit Metadata
Analyzed At
Oct 8, 2026, 04:48 PM
Package URL
pkg:socket/skills-sh/moonlight-lupin%2Fagent-skills%2Fclaude-plugin-converter%2F@62cf26b328a94493b4834ca3d7272167c40acaa82847e3da82d8c26f2f935aca