integrate-context-matic
Warn
Audited by Socket on Apr 2, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The stated purpose is plausible, but the skill's core dependency on an unverifiable external MCP intermediary is not well justified or documented, and it also instructs transitive skill installation. Data flows are broader than a simple documentation helper, with project context routed through context-matic and downstream code/package changes encouraged. No confirmed malware or overt credential theft is present, but the install-trust and intermediary-data-flow risks are significant.
Confidence: 82%Severity: 78%
Audit Metadata