skills/xixu-me/skills/skills-cli/Socket

skills-cli

Warn

Audited by Socket on Mar 28, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill is purpose-aligned, but its purpose is inherently risky because it instructs the agent to install and trust other skills from arbitrary third-party sources. There is no direct credential theft or covert exfiltration, but the transitive install model and broad source support create substantial supply-chain risk.

Confidence: 90%Severity: 84%

Audit Metadata

Analyzed At

Mar 28, 2026, 09:09 AM

Package URL

pkg:socket/skills-sh/xixu-me%2Fskills%2Fskills-cli%2F@d9259364ea5633d5a9a3194f5ea09fcdafe509e1