Skills/Claude Code plugins/ai-plugins

ai-plugins@2de0088

CAUTION

Publisher claims: "Set up endorctl and use Endor Labs to scan, prioritize, and fix security risks across your software supply chain" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Claude Code plugin marketplacePublisher endorlabs · joined 0 days agoInstalls 0Last detonated 55 min ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
npx invocation of non-well-known packageplugins/gemini/endor-labs-agent-kit/skills/endor-agent-kit-setup/SKILL.md:182 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageplugins/antigravity/endor-labs-agent-kit/skills/endor-agent-kit-setup/SKILL.md:173 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageplugins/cursor/endor-labs-agent-kit/skills/endor-agent-kit-setup/SKILL.md:162 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Hidden zero-width characters detectedREADME.md:35 · Hidden zero-width characters detected — may conceal content
AST07
HIGH
npx invocation of non-well-known packageplugins/claude/endor-labs-agent-kit/skills/endor-agent-kit-setup/SKILL.md:183 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionplugins/gemini/endor-labs-agent-kit/skills/cicd-posture/SKILL.md:163 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
npx invocation of non-well-known packageplugins/claude/ai-plugins/skills/endor-agent-kit-setup/SKILL.md:184 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageskills/endor-agent-kit-setup/SKILL.md:183 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionplugins/antigravity/endor-labs-agent-kit/skills/cicd-posture/SKILL.md:167 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionplugins/codex-directory/endor-labs-agent-kit/skills/cicd-posture/SKILL.md:152 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
File type combined with upload actionplugins/cursor/endor-labs-agent-kit/skills/cicd-posture/SKILL.md:168 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
npx invocation of non-well-known packageplugins/codex/endor-labs-agent-kit/skills/endor-agent-kit-setup/SKILL.md:207 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionplugins/codex/endor-labs-agent-kit/bundled-skills/cicd-posture/SKILL.md:158 · File type combined with upload action — agent may exfiltrate local data files
AST07