skills/chujianyun/skills/sync-skills/Socket

sync-skills

Warn

Audited by Socket on Mar 19, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill’s stated purpose matches its filesystem-copy behavior, but it is designed to propagate arbitrary third-party skills from unpinned GitHub repos or a third-party marketplace into agent skill directories. The biggest concern is transitive trust and indirect prompt-injection risk, not credential theft or confirmed malware.

Confidence: 90%Severity: 76%

Audit Metadata

Analyzed At

Mar 19, 2026, 04:19 PM

Package URL

pkg:socket/skills-sh/chujianyun%2Fskills%2Fsync-skills%2F@da694365b23982c7cff3d0531849da5f1535cbdc