m2m-client-credentials

Warn

Audited by Socket on Mar 1, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This skill/documentation provides legitimate, standard examples for implementing OAuth2 Client Credentials (M2M) with SSOJet. It is functionally consistent with its purpose and does not contain overtly malicious code or supply-chain download/execute patterns. The primary security concerns are operational: the examples log access tokens to stdout and the cURL snippet demonstrates passing client_secret on the command line — both are common pitfalls that can lead to credential leakage if example code is copied into production. Recommend updating examples to avoid printing raw tokens and to warn strongly against command-line secrets; emphasize using secrets managers and restricting scope/audience.

Confidence: 90%Severity: 75%
Audit Metadata
Analyzed At
Mar 1, 2026, 04:35 PM
Package URL
pkg:socket/skills-sh/ssojet%2Fskills%2Fm2m-client-credentials%2F@1b4fa27e52de01e315dbb7470813590d2f6fd392