skills/dalmia/calibrate-skills/iterate-evaluator/Socket

iterate-evaluator

Warn

Audited by Socket on Oct 23, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the evaluator-tuning purpose is coherent, but the skill combines silent self-update, transitive trust in the skills CLI, and an unverifiable authenticated `calibrate` CLI that can modify live evaluator state. The main concern is not prompt tuning itself; it is hidden behavior plus credentialed reliance on a CLI whose provenance was not established.

Confidence: 79%Severity: 86%

Audit Metadata

Analyzed At

Oct 23, 2026, 05:57 AM

Package URL

pkg:socket/skills-sh/dalmia%2Fcalibrate-skills%2Fiterate-evaluator%2F@2d68116af659211554c9137d9db4ce61751cecfaa74a55e6a00d8d04e26c5751