seemd

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly uploads local files to an external service (seemd.xyz) and autonomously runs remote code via npx, includes instructions to bypass an npx-wrapping security tool (rtk proxy) and to return only a terse URL (minimizing visibility), which together create clear data-exfiltration, supply‑chain/RCE, and security-evasion risks.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes npx @tentagrip/seemd at runtime (fetching and executing remote npm package code) and returns a share URL on https://seemd.xyz, so the npx/@tentagrip/seemd package is a required external dependency that executes remote code.