skills/bighardperson/computer-science-skills-collection/tapd-openapi/Socket

tapd-openapi

Warn

Audited by Socket on May 18, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill’s purpose and capabilities mostly align with legitimate TAPD automation, and there is no install/download-execute behavior. The main issue is data-flow integrity: TAPD credentials are sent to a fully configurable TAPD_API_ENDPOINT instead of a pinned official TAPD API domain, which makes credential forwarding possible if the environment is misconfigured or maliciously set.

Confidence: 90%Severity: 52%

Audit Metadata

Analyzed At

May 18, 2026, 01:05 AM

Package URL

pkg:socket/skills-sh/bighardperson%2Fcomputer-science-skills-collection%2Ftapd-openapi%2F@80693198e49455ad271bf097e30802ce489e81cc