doc-tspec-fixer
Audited by Socket on Mar 1, 2026
1 alert found:
SecurityThis SKILL is a repository-local document fixer for TSPECs: its stated purpose, capabilities, and file operations are coherent and consistent. It does not contain network exfiltration, credential-harvesting patterns, or remote download/execute instructions. The primary security concerns are operational rather than overtly malicious: automatic auto-merge of upstream changes (Tier 1/2) can modify repository content without fine-grained human approval, and invoking other skills introduces a transitive trust surface. Filesystem modifications (moves, writes, archive) are expected but can be destructive if misconfigured; the documented backup strategy mitigates this. Overall there is no evidence of malware or credential theft in the provided content, but the auto-merge automation and transitive invocation of other skills warrant review and operational controls (ensure human-in-the-loop for Tier 2/3 merges, restrict automatic runs in CI, and audit downstream skills).