payroll-payable-check-free

Warn

Audited by Socket on Sep 16, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS. The free skill's stated local payroll-checking purpose is mostly coherent and there is no direct evidence of data exfiltration in the free flow. However, it also acts as a funnel into installing and purchasing a separate skill via unpinned `npx @latest` and transitive skill installation, which is broader than necessary for a local accounting checker and creates meaningful supply-chain and trust-chain risk.

Confidence: 85%Severity: 58%
Audit Metadata
Analyzed At
Sep 16, 2026, 11:31 AM
Package URL
pkg:socket/skills-sh/chenqg618%2Fcompliance-skills%2Fpayroll-payable-check-free%2F@3fecd2c002a57d8e0d3f2be7cd3a2f3923fe26611da21acc97ba9480268bdf7e
Security Audit — socket — payroll-payable-check-free