skills/celeryhq/skills/smp-pm/Socket

smp-pm

Warn

Audited by Socket on May 6, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the stated purpose is coherent for project-management automation, but the skill's trust model is weak because it requires an unverifiable external `smp` CLI and forwards `SMP_TOKEN` to it. The data flows are proportionate to PM work, yet the unverified binary plus credential forwarding makes this a high-risk skill rather than a benign guide.

Confidence: 83%Severity: 84%

Audit Metadata

Analyzed At

May 6, 2026, 05:36 AM

Package URL

pkg:socket/skills-sh/celeryhq%2Fskills%2Fsmp-pm%2F@e347d869691b8f4a1fa3d6414e48bb6e6fc8a2ec