sync-system-bus

Warn

Audited by Socket on Mar 1, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This SKILL-style document is a deployment HOWTO for building and pushing a Docker image to GHCR and updating a Kubernetes deployment locally. The capabilities (building, authenticating with GH, pushing images, running kubectl, and calling joelclaw/slog) are directly aligned with the stated purpose. There is no evidence of obfuscated or malicious code embedded in the provided text. The primary security concerns are operational: the process requires high-privilege credentials (GH auth token, kubectl context) and performs high-impact remote actions. If the publish script referenced here were malicious or obtained from an untrusted source, it could misuse those credentials or perform harmful actions — but nothing in the supplied content shows that. Recommend: treat the publish script and any invoked binaries as sensitive: review k8s/publish-system-bus-worker.sh, ensure least-privilege credentials/service accounts are used, avoid exposing tokens/logging, and verify scripts before running. Overall, the document is coherent and appropriate for deploy operations but carries expected deployment-level risk due to credential and cluster access.

Confidence: 90%Severity: 75%
Audit Metadata
Analyzed At
Mar 1, 2026, 11:07 PM
Package URL
pkg:socket/skills-sh/joelhooks%2Fjoelclaw%2Fsync-system-bus%2F@0eb00bfc41e6756d4ed0088a895f1a994a040e48