skills/captainluzik/oh-my-embedded/component-sourcer/Socket

component-sourcer

Warn

Audited by Socket on Sep 22, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s purpose is legitimate and its data use is proportionate, but it relies on an unofficial third-party MCP package run via unpinned `npx -y`. This is mainly a supply-chain trust issue, not confirmed malicious behavior or credential theft.

Confidence: 87%Severity: 52%

Audit Metadata

Analyzed At

Sep 22, 2026, 11:36 AM

Package URL

pkg:socket/skills-sh/captainluzik%2Foh-my-embedded%2Fcomponent-sourcer%2F@8fb73f0431dfd59cce4d3b825b7ff69224967515043ff920b4524fc2263c2bc7