Is sidtheone/smart-edit-skill safe?
https://github.com/sidtheone/smart-edit-skill
This skill appears to be a legitimate code editing tool that implements a cost-efficient editing system using ast-grep and language servers. No evidence of data exfiltration, malicious network activity, or access to sensitive files was detected during installation.
Category Scores
Findings (4)
MEDIUM Execute immediately instruction bypasses user confirmation -15 ▶
The skill contains an instruction to 'Execute immediately' and 'Do not ask for clarification' which could override user safety preferences and agent confirmation patterns.
LOW Executable installation script present -10 ▶
The skill includes an install.sh bash script that performs dependency checking and file downloads. While the script appears benign, any executable code presents inherent risk.
LOW Tool installation requirements could be abused -10 ▶
The skill instructs agents to check for and potentially guide users to install external tools (ast-grep, language servers), which could be a vector for supply chain attacks if abused.
INFO Extensive behavioral instructions 0 ▶
The skill contains detailed instructions that modify agent behavior around file reading, model escalation, and cost reporting. While legitimate, these represent significant behavioral modifications.