100Critical
This code templating skill unnecessarily grants unrestricted
Behavior Analysis
Description verified — behavior matches claim
Claims to do
Corder Code Templates Skill: このSkillは、corderエージェントが新機能を実装する際に使用するコードテンプレート集です。REST APIエンドポイント、Reactコンポーネント、データベースモデル、認証ロジック、エラーハンドリングなど、頻出パターンのテンプレートを提供します。
Actually does
The skill uses the `Read` tool to access its internal code templates and the `Write` tool to output these templates into the user's project directory. It leverages the `Bash` tool to execute shell commands, likely for copying template files and potentially performing placeholder replacements within the user's file system. It does not contact any external URLs.
Skill Info
Nametakemi-ohama/ai-agent-marketplace/corder-code-templates
Registrygithub
Version515fdca65a97
PURLpkg:github/takemi-ohama/ai-agent-marketplace@515fdca65a97?skill=corder-code-templates
Stars1
Source
SHA-2564c2da9d7ea04...
SHA-141d5c3a6c310...
MD50dcd8f240360...
TLSH52f1c77d63f2...
ssdeep192:lbKqvAnS...
Size7,587 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
Claude CodeDocs
/plugin marketplace add takemi-ohama/ai-agent-marketplace/plugin install corder-code-templates@takemi-ohama/ai-agent-marketplaceclaude-marketplace
https://github.com/takemi-ohama/ai-agent-marketplace
Skills.shDocs
npx skills add https://github.com/takemi-ohama/ai-agent-marketplaceAssessments (1)
AI Agent Traps ↗Unrestricted Bash execution capabilitycriticalcommand execution
The skill is granted unrestricted Bash execution capabilities, which can be leveraged by a malicious agent or prompt for arbitrary command execution, data exfiltration, or system compromise. While the skill's stated purpose is code templating, Bash access is not strictly necessary for template generation and poses a significant security risk.
100% confidenceline 10
allowed-tools: - Bash
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/takemi-ohama/ai-agent-marketplace/corder-code-templates)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/takemi-ohama/ai-agent-marketplace/corder-code-templates"><img src="https://mondoo.com/ai-agent-security/api/badge/github/takemi-ohama/ai-agent-marketplace/corder-code-templates.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/takemi-ohama/ai-agent-marketplace/corder-code-templates.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow