skills/danielgwilson/luxin/image-to-3d/Socket

image-to-3d

Warn

Audited by Socket on Aug 8, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill's hosted image-to-3D purpose broadly matches its capabilities, and data flows stay within the Luxin service it describes. The main concerns are remote execution of a mutable npm CLI, transitive installation of another skill, and a hosted paid-action loop; these are proportionate but raise medium trust and supply-chain risk.

Confidence: 84%Severity: 58%

Audit Metadata

Analyzed At

Aug 8, 2026, 11:25 PM

Package URL

pkg:socket/skills-sh/danielgwilson%2Fluxin%2Fimage-to-3d%2F@837a157c96f97d0d64a43426d4d3f51d9273f9225ac01ef9e184d7b7ae84053f