skills/citypaul/.dotfiles/release-notes-helper/Socket

release-notes-helper

Warn

Audited by Socket on Oct 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the stated purpose is modest, but the provided content is only a transitive installer for an unverified third-party skill. The npm CLI itself appears legitimate, yet the main risk is delegating agent trust to `example/release-notes-helper` and installing it globally across agents.

Confidence: 88%Severity: 72%

Audit Metadata

Analyzed At

Oct 17, 2026, 10:07 PM

Package URL

pkg:socket/skills-sh/citypaul%2F.dotfiles%2Frelease-notes-helper%2F@8a8efbfeceaadb6802183c5a3e15d77605bcec5a3177435eea9fd89e7f4d197e