kamino-liquidity

Warn

Audited by Socket on Apr 9, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated Kamino vault purpose is plausible, but the actual footprint is broader: remote script execution, direct binary download, transitive skill installation, and install-time telemetry with device fingerprinting. The financial-action scope is partially constrained by confirmation requirements, but the install/data-flow model is not proportionate enough to classify as benign.

Confidence: 89%Severity: 86%
Audit Metadata
Analyzed At
Apr 9, 2026, 02:36 AM
Package URL
pkg:socket/skills-sh/MigOKG%2Fplugin-store%2Fkamino-liquidity%2F@35a902babce5cef25e414240c1f050d8a8fb2f72