skills/membranedev/application-skills/pulumi/Socket

pulumi

Warn

Audited by Socket on Apr 23, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill is not overtly malicious and uses an official npm package from the same vendor, but its actual footprint is a Membrane platform integration that proxies Pulumi access through a third party. That creates medium risk from intermediary data flow and credential trust expansion, plus low supply-chain risk from installing an unpinned external CLI.

Confidence: 85%Severity: 57%

Audit Metadata

Analyzed At

Apr 23, 2026, 03:04 PM

Package URL

pkg:socket/skills-sh/membranedev%2Fapplication-skills%2Fpulumi%2F@1f1d0e6d29d368c47736f346c9b355c9af728b37