Security audit
Security checks for vulnerabilities and agentic risk
This skill provides coherent axios compromise detection and cleanup guidance, with some elevated remediation commands users should apply carefully.
Install is reasonable for axios incident response. Before running remediation commands, confirm the indicators match your environment, back up or review package files, and treat sudo hosts/firewall changes as system-wide changes that may need manual reversal.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
rm -rf node_modules/plain-crypto-js npm install --ignore-scripts
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
# Linux/macOS — /etc/hosts
echo "0.0.0.0 sfrclak.com" | sudo tee -a /etc/hosts
# Linux firewall
sudo iptables -A OUTPUT -d 142.11.206.73 -j DROP
The skill instructs users to append a host-block entry to /etc/hosts using sudo, which modifies system-wide configuration with elevated privileges. Even though the security goal is legitimate, the guidance lacks an explicit warning about requiring admin rights, changing host resolution for the whole system, and the need to revert the change later if it causes unintended connectivity issues.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Linux/macOS — /etc/hosts
echo "0.0.0.0 sfrclak.com" | sudo tee -a /etc/hosts
# Linux firewall
sudo iptables -A OUTPUT -d 142.11.206.73 -j DROP
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Linux/macOS — /etc/hosts
echo "0.0.0.0 sfrclak.com" | sudo tee -a /etc/hosts
# Linux firewall
sudo iptables -A OUTPUT -d 142.11.206.73 -j DROP
The sudo iptables command changes outbound firewall behavior and can affect network connectivity beyond the scope of the package investigation. In a remediation skill this is contextually understandable, but without an explicit warning about privilege requirements, potential disruption, persistence differences across systems, and rollback steps, users may apply a risky system change unsafely.