dapr-integration

Warn

Audited by Socket on Feb 21, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

[Skill Scanner] [Documentation context] Credential file access detected This skill is documentation and examples for integrating Dapr building blocks. I found no embedded malicious code or obfuscated payloads. The primary risks are insecure configuration defaults (disabled TLS for Kafka, empty Redis password), a possibly incorrect install instruction (`uv add`), and broad access to Kubernetes secrets via the secrets store component — all of which are operational security issues rather than explicit malware. Treat the examples as development-only defaults and harden configurations (enable TLS/auth, use proper installation instructions, limit Dapr RBAC) before deploying to production. LLM verification: [LLM Escalated] This package is legitimate instructional material for integrating Dapr into microservices and contains typical example code. I found no evidence of explicit malware or covert exfiltration code. However, the examples include insecure default configurations (disabled TLS for Kafka, empty Redis password), documentation mentions kubeconfig-like paths, and some instructions/snippets appear inaccurate or nonstandard (potential typos or API mismatches). These issues increase operational security risk i

Confidence: 80%Severity: 75%
Audit Metadata
Analyzed At
Feb 21, 2026, 12:28 PM
Package URL
pkg:socket/skills-sh/maneeshanif%2Ftodo-spec-driven%2Fdapr-integration%2F@38c41185d8124771b731e9412419cf41658a6dbe