skills/dokhacgiakhoa/agent-skills-4-vibe-coding-cli/daily-news-report/Socket

daily-news-report

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The stated purpose is benign and the data sources are coherent, but the execution model is not proportionate: a scheduled workflow runs an unpinned external npm CLI and forwards API secrets to it. This is mainly a supply-chain and credential-forwarding risk, not confirmed malware.

Confidence: 85%Severity: 82%

Audit Metadata

Analyzed At

Sep 17, 2026, 02:22 PM

Package URL

pkg:socket/skills-sh/dokhacgiakhoa%2Fagent-skills-4-vibe-coding-cli%2Fdaily-news-report%2F@1a9cee3ee4075cc4dd705e5e3762caa1ed10f934dbd1a0ff6cd4a547f3d0ddd7