skill2team@1.9.2
VERIFIED· install onlyPublisher claims: "It is designed for the point where a skill has become too complex to maintain as one large instruction set, especially when design work, audit work, review gates, execution flow, and deployment assumptions are mixed together. Skill2Team converts that kind of complex skill into a multi-agents team" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Auto-update or dynamic fetch configurationscripts/generate_deployment_package.py:1571 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…us=real_session_target_subagents`, `registered_target_team_smoke_status=pending_hot_reload_or_new_thread`, and `registered_agent_invocation_verified=false`.\n" "Use this path only when registered target-age…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationSKILL.md:138 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…us=real_session_target_subagents`, `registered_target_team_smoke_status=pending_hot_reload_or_new_thread`, and explicit entry/specialist/reviewer boundaries. If neither registered handoff nor real current-session target subagents are avail…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationscripts/generate_deployment_package.py:2948 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…al_session_target_subagents`, keep `registered_target_team_smoke_status=pending_hot_reload_or_new_thread`, keep `registered_agent_invocation_verified=false`, and must not claim registered target-team execution. Before registration, use thi…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationscripts/generate_deployment_package.py:3177 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…us=real_session_target_subagents`, `registered_target_team_smoke_status=pending_hot_reload_or_new_thread`, and `registered_agent_invocation_verified=false`. If you cannot hand off to required specialists by either path, stop with `target-t…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/generate_deployment_package.py:1720 · File type combined with upload action — agent may exfiltrate local data files
AST07"design-output.zip, design-output-manifest.json, and docs/design-output-archive.md",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/generate_deployment_package.py:3193 · File type combined with upload action — agent may exfiltrate local data files
AST07… simulation. Design results live in design-output.zip and design-output-manifest.json; package-end Codex register/start templates live in docs/post-package-prompt-templates.md. Agent profiles live in agent-profiles.json and profiles/*.agen…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/generate_deployment_package.py:2940 · File type combined with upload action — agent may exfiltrate local data files
AST07…t include `docs/register-readiness-contract.md` and `register-readiness-contract.json` so `post-package Codex registration/use guidance` can enforce the hard runtime requireme…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Auto-update or dynamic fetch configurationscripts/register_codex_agents.py:398 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06"`registered_target_team_smoke_status=pending_hot_reload_or_new_thread`, and `registered_agent_invocation_verified=false`. "Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/generate_deployment_package.py:1553 · File type combined with upload action — agent may exfiltrate local data files
AST07…is shared target-team package in Codex.\n" "Read s2t-agent-registry.json, agent-profiles.json, entry-agent-startup-welcome.json, local-resource-allocation.map.json, source-resource-manifest.json, .codex/config.toml, .codex/agents/*.toml, d…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionprompts/final-report-template.md:32 · File type combined with upload action — agent may exfiltrate local data files
AST07…package release/resource-gate analysis that reads `local-resource-allocation.map.json` and `source-resource-manifest.json`, Codex post-package registration/use guidance, registered entry-agent use after real Codex …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/ensure_codex_meta_team.py:112 · Python subprocess execution detected
AST05return subprocess.run(cmd, text=True, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈3,399 tok
1 file · 84 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.