agentic-awesome-skills@19.15.0

Summary

Package ships a large collection of 'skills' subdirectories (8234 files scanned), each containing its own helper scripts. Static patterns matched on keyword co-occurrence: Python scrapers using GET/POST and ping (skills/junta-leiloeiros/scripts/scraper/base_scraper.py, serve_api.py), a benchmark runner script (skills/loki-mode/benchmarks/run-benchmarks.sh) containing curl invocations and an 'install' token, an rclone installer helper that fetches from the official rclone.org domain (skills/rclone-cli/scripts/install.sh line 15: curl https://rclone.org), and a youtube-notetaker verify.sh issuing curl GETs. The matched destinations are either the project's own official domain (rclone.org) or generic verb/keyword co-occurrence in domain-specific tooling; no hardcoded attacker C2, no browser/credential store enumeration, no shipped third-party credentials, no wallet/seed scanning, and no evidence of install-time fetch-and-execute from an anonymous or author-mutable host were observed in the matched excerpts. The scripts are not wired to npm lifecycle hooks that would auto-run on install of the npm package itself.

Source: amazon-inspector (bce718f3dabec30c962c7aecf6eb41f2583d7158f48af6dca9ec8adac61f6297)