skills/ruvnet/ruflo/github-automation/Socket

github-automation

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated GitHub automation purpose is coherent, and official `gh` usage is benign, but the skill unnecessarily routes core actions through unpinned third-party `npx claude-flow` commands with unclear publisher continuity and unspecified data flows. This is mainly a supply-chain and credential-adjacent trust issue rather than confirmed malware.

Confidence: 83%Severity: 61%

Audit Metadata

Analyzed At

Sep 15, 2026, 11:38 AM

Package URL

pkg:socket/skills-sh/ruvnet%2Fruflo%2Fgithub-automation%2F@d660b0678c2766fca318274794bf0ece4fdbdb1008a8f73c63b631cbb72bf69f