Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local security scanner wrapper with a few supply-chain and update cautions, but no artifact-backed malicious behavior.
Before installing, verify that the ironheights npm package and linked GitHub repository are the sources you intend to trust. Consider installing a specific vetted version rather than using unpinned npx, and be aware that the update path can contact npm/ClawHub and update the scanner unless disabled.
Referenced artifact was not completely inspected
folder> --json`. It rescans only skills that are new or whose content hash or `SKILL.md` version differs from their last scan, and it records the new state in
Referenced artifact was not completely inspected
folder> --json`. It rescans only skills that are new or whose content hash or `SKILL.md` version differs from their last scan, and it records the new state in
The skill recommends npx ironheights without pinning a specific version, which can cause execution of whatever version npm resolves at runtime. That creates a supply-chain risk: a newly published malicious or compromised package version could be fetched and run immediately, especially problematic in a security tool users are encouraged to trust.
No suspicious patterns detected.