cali-ops-github-releases

Warn

Audited by Socket on Jul 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

The skill is broadly aligned with GitHub release automation, but its footprint is more powerful than a normal helper: it tells the agent to act automatically, modifies the repo state, executes repo-configured shell commands with eval, and can run an unpinned third-party gh extension using GitHub auth context. This is better classified as suspicious/high-risk automation rather than malware.

Confidence: 91%Severity: 74%
Audit Metadata
Analyzed At
Jul 18, 2026, 10:50 AM
Package URL
pkg:socket/skills-sh/calionauta%2Fagent-sync-public%2Fcali-ops-github-releases%2F@1661b5b9b6b0683375289675293557d5fed6b17941c7a747b08ac4b5fd3c5f07
Security Audit — socket — cali-ops-github-releases