skills/arcreel/skills/setup-arcreel-skills/Socket

setup-arcreel-skills

Warn

Audited by Socket on Sep 1, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the capability mostly matches the purpose, but the skill persistently stores a high-value API key in plaintext and allows sending it to any user-configured MCP endpoint instead of constraining to a verifiable official ArcReel host. No malware or installer abuse is evident, but credential-routing and persistence are broader than ideal.

Confidence: 85%Severity: 55%

Audit Metadata

Analyzed At

Sep 1, 2026, 06:04 AM

Package URL

pkg:socket/skills-sh/arcreel%2Fskills%2Fsetup-arcreel-skills%2F@da1f696e4c42352576ffda9f6b95b185fa86c285516c0a22a586551081ebc4c7