skills/atman-33/agent-harness/setup-all/Socket

setup-all

Warn

Audited by Socket on Jul 29, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill's local scaffolding behavior is benign and aligned, but its main Phase 1 behavior installs multiple unpinned third-party skills from a personal GitHub repository, creating a transitive trust chain with significant supply-chain risk. OpenSpec setup is comparatively normal; the primary concern is delegated installation of mutable external skills.

Confidence: 87%Severity: 78%

Audit Metadata

Analyzed At

Jul 29, 2026, 12:05 PM

Package URL

pkg:socket/skills-sh/atman-33%2Fagent-harness%2Fsetup-all%2F@a948723bac8850ca54ad820a9cb4444449e7dece219dc8fcb86e7c0a2a982d55