skills/x-cmd/skill/zhipu/Socket

zhipu

Warn

Audited by Socket on Apr 10, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill's stated purpose is coherent, but it depends on a third-party x-cmd wrapper and alias rather than a clearly official Zhipu CLI, and it asks users to place a Zhipu API key into that wrapper. The main concern is install and credential trust, not confirmed malware or clear exfiltration.

Confidence: 83%Severity: 58%

Audit Metadata

Analyzed At

Apr 10, 2026, 05:43 AM

Package URL

pkg:socket/skills-sh/x-cmd%2Fskill%2Fzhipu%2F@c11548b16f2fed37d4ec9442858327865a90e2da