doc-tspec-fixer

Warn

Audited by Socket on Mar 1, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This SKILL is a repository-local document fixer for TSPECs: its stated purpose, capabilities, and file operations are coherent and consistent. It does not contain network exfiltration, credential-harvesting patterns, or remote download/execute instructions. The primary security concerns are operational rather than overtly malicious: automatic auto-merge of upstream changes (Tier 1/2) can modify repository content without fine-grained human approval, and invoking other skills introduces a transitive trust surface. Filesystem modifications (moves, writes, archive) are expected but can be destructive if misconfigured; the documented backup strategy mitigates this. Overall there is no evidence of malware or credential theft in the provided content, but the auto-merge automation and transitive invocation of other skills warrant review and operational controls (ensure human-in-the-loop for Tier 2/3 merges, restrict automatic runs in CI, and audit downstream skills).

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Mar 1, 2026, 09:02 AM
Package URL
pkg:socket/skills-sh/vladm3105%2Faidoc-flow-framework%2Fdoc-tspec-fixer%2F@c418470f7946b95971817a13cd6c953dc782fa1b