expression-language-injection

Warn

Audited by Socket on Apr 22, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

该 skill 是面向 AI 代理的漏洞利用方法论,直接提供 EL 注入到远程命令执行的 payload、绕过和 CVE 操作步骤。虽无可疑安装链、无凭证窃取或第三方中转,但其实际能力与“exploit”定位一致且本身属于高风险攻击技能,应判定为高风险而非恶意供应链。

Confidence: 96%Severity: 93%
Audit Metadata
Analyzed At
Apr 22, 2026, 10:10 AM
Package URL
pkg:socket/skills-sh/wgpsec%2FAboutSecurity%2Fexpression-language-injection%2F@3d13cf6fac4f141a2a3cebc250e6983c93d5d931