github.com/Sanskar015/claude-skills-supercharged · main · scanned 2 h ago · 6 config files

7 agent components in Sanskar015/claude-skills-supercharged: an installer lure (malware delivery pattern), 4 unvetted.

Components70 MCP servers
High blast radius1credentials, shell or unvetted code
Credentials handed to agents0none seen
Not vetted4of 4 local servers, skills and plugins
ComponentWhereVerdictBlast radius
Installer lure (malware delivery pattern)Installer lure · any agent
README.mdmalware pattern
high
  • Archive committed in an agent bundle
  • Payload hidden under .claude/hooks
  • README links to a committed installer
api-securitySkill · Claude Code
.claude/skills/api-security/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
git-workflowSkill · Claude Code
.claude/skills/git-workflow/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
python-best-practicesSkill · Claude Code
.claude/skills/python-best-practices/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
skill-developerSkill · Claude Code
.claude/skills/skill-developer/SKILL.mdnot vetted
low
  • adds instructions and scripts the agent will follow
  • has no KillerSkills verdict yet
slash command: wrapInstructions · Claude Code
.claude/commands/wrap.mdclean
low
  • is read by the agent as instructions on every session
UserPromptSubmitHook · Claude Codeskill-activation-prompt.sh
.claude/settings.jsonlocal command
low
  • runs `skill-activation-prompt.sh` on every tool call, as the developer
What to do about it
  • Do not download or run anything from this repository. Its README sends readers to a committed installer and tells them to click past Windows' own warning; that is how the Agent Lure Stealer campaign (Nov 2026) delivers an infostealer. Real skills and MCP servers install from source, never from a ZIP.
  • Unvetted means we have no sandbox run for that exact package. Ask your agent to check before installing: claude mcp add killerskills -- npx -y vet-skills mcp
  • For a whole organization (every repo and laptop, rescanned daily, with removal across machines), see Discovery for teams.
Share: https://killerskills.ai/scan/github/Sanskar015/claude-skills-superchargedRescan nowScan another