markdown-formatter

Warn

Audited by Socket on Sep 8, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/sync-tap-payload.js

This fragment is best characterized as a local installer/synchronizer that stages and atomically replaces the “skills/markdown-formatter” directory using a bundled file list. In the snippet itself there are no clear malicious behaviors (no network/exfiltration or runtime execution). However, it makes specific files executable and performs destructive directory replacement based entirely on ./runtime-payload content; therefore the overall risk depends on whether the packaged payload and runtime-payload file list are trustworthy and path-safe (not shown here).

Confidence: 56%Severity: 48%
Audit Metadata
Analyzed At
Sep 8, 2026, 12:32 PM
Package URL
pkg:socket/skills-sh/codesigils%2Fzero-md-formatter%2Fmarkdown-formatter%2F@985df206ddb5fe9081a43ed13971682205e75b1d
Security Audit — socket — markdown-formatter