logic-master

Fail

Audited by Socket on Feb 16, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
SKILL.md

The document is a high-risk operational workflow: it instructs operators to bypass sandboxing and auto-approve changes via a '--yolo' flag and delegates privileged edits to subagents without requiring strong provenance or human-in-the-loop controls. There is no direct malicious payload in the text, but following these instructions increases the probability of supply-chain compromise, data exfiltration, and unauthorized repository modification if the codex CLI or its service endpoints are untrusted. Recommend: do not run unverified codex binaries; require signed releases and checksums; remove or gate '--yolo' auto-approve behavior behind multi-step human confirmations; restrict workspace-write access; and sanitize/limit files sent to remote services (exclude .env, secrets, keys).

Confidence: 98%
Audit Metadata
Analyzed At
Feb 16, 2026, 10:16 AM
Package URL
pkg:socket/skills-sh/mineru98%2Fskills-store%2Flogic-master%2F@ad2fb340227b2dc17e5d84f2f822149c95747a8f