import-skill

Warn

Audited by Socket on Jul 24, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the skill’s purpose is coherent, but it is inherently high-risk because it vendors untrusted third-party skills into a trusted local catalog and registers them for later use. The main concern is transitive skill installation plus broad import of executable/instructional content, not confirmed malware.

Confidence: 91%Severity: 82%
Audit Metadata
Analyzed At
Jul 24, 2026, 11:34 AM
Package URL
pkg:socket/skills-sh/dotlas%2Fskills%2Fimport-skill%2F@33f2621ad3b121902752aad2ab0beeb428fbfe977987c31ee4508075683a6056
Security Audit — socket — import-skill