review-codex
Warn
Audited by Socket on Apr 11, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: the stated purpose is plausible, but the skill is mostly a wrapper that runs unpinned third-party code with broad `bunx` shell permission. The main concern is supply-chain and delegated data flow risk, not confirmed malware.
Confidence: 79%Severity: 58%
Audit Metadata