model-extraction
Warn
Audited by Socket on Oct 16, 2026
2 alerts found:
Securityx2SecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the skill is internally consistent, but its purpose is to equip an AI agent with offensive model-theft capabilities and evasion tactics. There is little supply-chain or credential risk, yet the operational impact is high because it automates exploit-style extraction against external AI services.
Confidence: 95%Severity: 86%
Securityassets/extraction-config.yaml
MEDIUMSecurityMEDIUM
assets/extraction-config.yaml
This YAML configuration describes model extraction and includes explicit measures to evade query monitoring and rate limits. It contains no executable behavior or direct malware indicators, but presents a significant misuse risk if applied to a model without authorization. No domains, URLs, IP addresses, file paths, or credentials are present.
Confidence: 98%Severity: 72%
Audit Metadata