mcp-orchestrator

Warn

Audited by Socket on Apr 5, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated purpose broadly matches MCP orchestration, but the actual footprint is too open-ended: auto-discovery, auto-installation, and auto-credential setup across thousands of third-party tools without trust boundaries, verification, or endpoint constraints. This is more a high-risk transitive execution and credential-forwarding framework than a narrowly scoped MCP helper.

Confidence: 86%Severity: 84%
Audit Metadata
Analyzed At
Apr 5, 2026, 08:31 AM
Package URL
pkg:socket/skills-sh/badhope%2Fskill%2Fmcp-orchestrator%2F@27fee65ac6c8e4a9ae6a8dc2e69084baa36d48f9