Skills/Claude Code plugins/confidence

confidence@0.9.0

CAUTION

Publisher claims: "Access Confidence feature flags, experiments, and migration tools directly from Claude Code." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Claude Code plugin marketplacePublisher spotify · joined 0 days agoInstalls 0Last detonated 3 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Account verification phishing language detected; Rule modification attempt. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathsskills/analyze-project/SKILL.md:454 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Account verification phishing language detectedevals/README.md:121 · Account verification phishing language detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
CRITICAL
Rule modification attemptskills/migrate-statsig/SKILL.md:1333 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptskills/migrate-eppo/SKILL.md:1271 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentskills/migrate-optimizely/SKILL.md:2847 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsskills/analyze-project/SKILL.md:551 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/instrument-events/SKILL.md:197 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Rule modification attemptskills/migrate-eppo/SKILL.md:1272 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsskills/analyze-project/SKILL.md:461 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/analyze-project/SKILL.md:459 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/analyze-project/SKILL.md:458 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Rule modification attemptskills/migrate-statsig/SKILL.md:1337 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Outbound HTTP to raw IP addressskills/migrate-optimizely/SKILL.md:776 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsskills/setup-warehouse-databricks/SKILL.md:220 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addressskills/migrate-statsig/SKILL.md:413 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Prompting user to enter sensitive credentialsskills/migrate-optimizely/SKILL.md:583 · Prompting user to enter sensitive credentials — social engineeringFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Auto-update or dynamic fetch configurationskills/migrate-optimizely/test-fixtures/phase2-examples/node-decide-server/src/server.js:6 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsskills/instrument-events/SKILL.md:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addressskills/migrate-eppo/test-fixtures/server.py:1178 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsskills/instrument-events/SKILL.md:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Refusal suppressionskills/migrate-optimizely/SKILL.md:2905 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationskills/migrate-optimizely/test-fixtures/phase2-examples/openfeature-provider-swap/src/provider.ts:33 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addressskills/migrate-eppo/SKILL.md:365 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Authorization escalation languageskills/onboard-confidence-dry-run/SKILL.md:1112 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageskills/setup-warehouse-databricks/SKILL.md:123 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Outbound HTTP to raw IP addressskills/migrate-optimizely/test-fixtures/server.py:946 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressskills/migrate-statsig/test-fixtures/server.py:697 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
References a credential file in the home directoryskills/setup-warehouse-databricks/SKILL.md:220 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsskills/instrument-events/SKILL.md:200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Authorization escalation languageskills/setup-warehouse-databricks/SKILL.md:189 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL using raw IP addressskills/migrate-optimizely/SKILL.md:776 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressskills/migrate-statsig/SKILL.md:413 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addressskills/migrate-statsig/test-fixtures/server.py:697 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
References a credential file in the home directoryskills/setup-warehouse-redshift/SKILL.md:160 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
URL using raw IP addressskills/migrate-eppo/test-fixtures/server.py:1178 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsskills/setup-warehouse-redshift/SKILL.md:160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using raw IP addressskills/migrate-eppo/SKILL.md:365 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedskills/onboard-confidence/auth.py:80 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addressskills/migrate-optimizely/test-fixtures/server.py:946 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandskills/analyze-project/SKILL.md:13 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/onboard-confidence/SKILL.md:786 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/migrate-eppo/SKILL.md:1067 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim spotify: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Prompting user to enter sensitive credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to Claude Code plugins, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim spotify