skills/firzus/agent-skills/setup-project/Socket

setup-project

Warn

Audited by Socket on Aug 10, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The core repo-inspection and AGENTS.md drafting behavior fits the stated purpose, and GitHub CLI use is proportionate when user-approved. The main concern is the explicit transitive installation of another skill from an unverified GitHub publisher; that extends trust beyond this skill's local setup role even though no direct credential theft or covert exfiltration is shown.

Confidence: 88%Severity: 72%

Audit Metadata

Analyzed At

Aug 10, 2026, 07:35 PM

Package URL

pkg:socket/skills-sh/firzus%2Fagent-skills%2Fsetup-project%2F@e2c3af472c48228994a8d3b1fd3190237476a5f0d7edd725febdd55230d9a71f