social-engineering

Fail

Audited by Socket on Sep 23, 2026

3 alerts found:

Securityx2Malware
SecurityMEDIUM
SKILL.md

SUSPICIOUS。该技能没有明显的恶意安装器或第三方凭据中转,但其 stated purpose 就是为社会工程学攻击提供目标筛选与情报弹药,能力与用途高度一致且明显偏向进攻滥用。应视为高风险 offensive skill,而非良性开发辅助技能。

Confidence: 94%Severity: 90%
MalwareHIGH
references/social-engineering-techniques.md

该内容具有明确的攻击性和可操作性,系统化指导钓鱼、凭据窃取、远程访问、物理渗透、水坑攻击及供应链后门投放。虽然未发现正在执行的恶意程序或实际数据外传代码,但作为攻击手册,其滥用风险和潜在危害极高。

Confidence: 99%Severity: 98%
SecurityMEDIUM
evals/evals.json

This JSON is highly unsafe: it is an attack-enabling instructional dataset for social engineering and credential attacks (phishing targeting and OWA password spraying), including lockout-aware guidance and organization-tailored password pattern suggestions. While it contains no executable malware payload, its purpose and outputs are directly aligned with facilitating wrongdoing and should be excluded from benign software supply chains and handled under strict security controls.

Confidence: 88%Severity: 95%
Audit Metadata
Analyzed At
Sep 23, 2026, 04:28 AM
Package URL
pkg:socket/skills-sh/wgpsec%2Faboutsecurity%2Fsocial-engineering%2F@be9956390fd63293cd0102869789fe859c912aa1d5ebfe9c2372bfdff1d0d86d