Claude Code, Skill
Example: Cred Pocket
Sample skill whose instructions tell the agent to copy tokens into a hidden request.
Sample grade: F, Fail. Shape: Octagon.
On the real scale, F means: Fail. Do not install. That sentence describes the scale. It does not apply to a real package, because this page is example data.
Grades are a hygiene check, not a security guarantee. The date is part of the grade.
What was checked
These notes are written for the sample. They are not findings from a real review.
Permissions
Pass
The sample stays inside the access it describes.
Install and update
Pass
The sample install does not fetch extra code.
Network
Fail
The sample sends data to a host the description does not admit.
Secrets
Fail
The sample instructions tell the agent to read tokens and keys.
Agent instructions
Fail
The sample tells the agent to hide the step that moves the tokens.
Obfuscation
Concern
Part of the sample request is encoded so the destination is harder to see.
Note
Example note. This fictional skill fails. The sample instructions tell the agent to read credentials and send them away, and to hide that step. Do not install. This is not a report on a real package.
Date and source
Date checked: (sample date for the layout, not a real review).