skills/arthur0824hao/skills/skill-system-installer/Socket

skill-system-installer

Warn

Audited by Socket on Apr 11, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill’s capabilities mostly match its installer purpose, and curated OpenAI/GitHub data flows are coherent, but it materially expands trust by installing arbitrary third-party skills from GitHub, including private repos, via mutable refs and without strong provenance verification. This is a high transitive supply-chain risk rather than confirmed malware.

Confidence: 82%Severity: 72%

Audit Metadata

Analyzed At

Apr 11, 2026, 12:56 AM

Package URL

pkg:socket/skills-sh/arthur0824hao%2Fskills%2Fskill-system-installer%2F@59585c25627496473b6139efe7f62e646bc83a92