skills/bnayae/bnaya-agent-skills/cost-aws/Socket

cost-aws

Warn

Audited by Socket on Apr 1, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill's purpose is coherent, but its install instructions are not: it points to unofficial `uvx` package names instead of AWS Labs' documented MCP servers. Because those packages are executed on demand and may receive AWS credentials, the supply-chain and credential-forwarding risk is high relative to a cost-estimation skill.

Confidence: 93%Severity: 86%

Audit Metadata

Analyzed At

Apr 1, 2026, 07:46 AM

Package URL

pkg:socket/skills-sh/bnayae%2Fbnaya-agent-skills%2Fcost-aws%2F@85bfe41df0ebb215adf1d1a1bfbae0445462278d