skills/carpenter-singh-lab/catalog-skills/scaffold-catalog/Socket

scaffold-catalog

Warn

Audited by Socket on Jun 16, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the core scaffolding behavior is coherent with the stated purpose, but the skill also installs another skill via unpinned `npx` and then relies on that installed skill's scripts for validation. The main concern is transitive trust and medium supply-chain risk, not confirmed malicious behavior.

Confidence: 100%Severity: 60%

Audit Metadata

Analyzed At

Jun 16, 2026, 01:16 PM

Package URL

pkg:socket/skills-sh/carpenter-singh-lab%2Fcatalog-skills%2Fscaffold-catalog%2F@3eec0f2fe0eda9ac635093d969a4624a08c1daac824454d3206fd93a65b56c6b