friction-log

Warn

Audited by Socket on Aug 23, 2026

1 alert found:

Security
SecurityMEDIUM
passive/SKILL.md

SUSPICIOUS: the skill’s core purpose is plausible, but it exports conversation-derived data to an unverifiable third-party Vercel endpoint and does so automatically at session end, with reduced transparency on failure. The capability is adjacent to the stated purpose, but the remote data flow and weak service provenance make the skill higher risk than a local-only friction reporter.

Confidence: 87%Severity: 74%
Audit Metadata
Analyzed At
Aug 23, 2026, 06:37 PM
Package URL
pkg:socket/skills-sh/aurorascharff%2Fagent-friction-skill%2Ffriction-log%2F@8571675687b78f2b61257e064dc49351557a41a7
Security Audit — socket — friction-log