dapr-integration
Audited by Socket on Feb 21, 2026
1 alert found:
Security[Skill Scanner] [Documentation context] Credential file access detected This skill is documentation and examples for integrating Dapr building blocks. I found no embedded malicious code or obfuscated payloads. The primary risks are insecure configuration defaults (disabled TLS for Kafka, empty Redis password), a possibly incorrect install instruction (`uv add`), and broad access to Kubernetes secrets via the secrets store component — all of which are operational security issues rather than explicit malware. Treat the examples as development-only defaults and harden configurations (enable TLS/auth, use proper installation instructions, limit Dapr RBAC) before deploying to production. LLM verification: [LLM Escalated] This package is legitimate instructional material for integrating Dapr into microservices and contains typical example code. I found no evidence of explicit malware or covert exfiltration code. However, the examples include insecure default configurations (disabled TLS for Kafka, empty Redis password), documentation mentions kubeconfig-like paths, and some instructions/snippets appear inaccurate or nonstandard (potential typos or API mismatches). These issues increase operational security risk i