skills/clawlink-hq/skills/intercom/Socket

intercom

Warn

Audited by Socket on Jun 28, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s stated Intercom purpose is coherent, and the npm-based CLI source appears plausibly same-org, but the core design routes Intercom authentication and data through ClawLink as a third-party intermediary. That creates meaningful credential-forwarding and data-flow risk, especially because the skill enables authenticated write actions in a real external service.

Confidence: 88%Severity: 68%

Audit Metadata

Analyzed At

Jun 28, 2026, 02:45 PM

Package URL

pkg:socket/skills-sh/clawlink-hq%2Fskills%2Fintercom%2F@10c2213108073b712696f2c56a36a27746cb72cec3f1cfa080e269b1af22fe74