vp-foreign-agent-skill-loader

Warn

Audited by Socket on Oct 6, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the skill's stated purpose matches its behavior, but it is a loader for untrusted foreign skill instructions and therefore materially increases indirect prompt-injection and transitive-trust risk. No direct malware indicators, credential harvesting, or remote installers are present in the provided snippet.

Confidence: 87%Severity: 58%
Audit Metadata
Analyzed At
Oct 6, 2026, 10:05 AM
Package URL
pkg:socket/skills-sh/vdustr%2Fskills%2Fvp-foreign-agent-skill-loader%2F@1d62d0ea7b1e64a8b8a7f865ac9942c02f0f711bce63a966d5c0731c57f0abc3