skills/callumflack/skills/react-build-lens/Socket

react-build-lens

Warn

Audited by Socket on Oct 6, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the core purpose is coherent and the local-file/doc workflow is proportionate, but the skill expands trust by instructing the agent to install additional remote skills, including one from a personal GitHub repo, using unpinned `npx` commands. This is a moderate transitive supply-chain risk rather than confirmed malicious behavior.

Confidence: 91%Severity: 56%

Audit Metadata

Analyzed At

Oct 6, 2026, 11:52 PM

Package URL

pkg:socket/skills-sh/callumflack%2Fskills%2Freact-build-lens%2F@749c9481c3d9b53c74a07988fdfdea3502ebfdb25ef75fbc533cbc17b640f08e