sprites-dev
Warn
Audited by Socket on Apr 12, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The official Sprite-management capability is coherent, but the skill overreaches by mandating a personal-repo `curl|bash` bootstrap and forwarding a Tailscale auth key into that installer. Combined with broad remote admin powers and SSH agent forwarding, the skill’s actual footprint is materially larger and riskier than its stated management purpose.
Confidence: 91%Severity: 86%
Audit Metadata