semver-range-resolve

Warn

Audited by Socket on Aug 18, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core semver purpose is coherent, but the skill couples a simple resolver to remote paid execution, a fallback download-and-run helper, and private-key-based authorization. The largest issue is credential forwarding to an externally fetched executable without strong release verification, making the overall footprint disproportionate to the task.

Confidence: 84%Severity: 82%
Audit Metadata
Analyzed At
Aug 18, 2026, 05:18 AM
Package URL
pkg:socket/skills-sh/fittings-sh%2Fskills%2Fsemver-range-resolve%2F@b2e2af2c85caf24582be9c8d9de4f5e005a828b28290b1e8a3ec69c8302f6139