git-release-finish

Warn

Audited by Socket on Oct 29, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

The release workflow is broadly consistent with its stated Git purpose and shows no clear credential theft, exfiltration, or malicious payload. The principal concern is the prerequisite fallback: it installs every skill globally from an unpinned external repository, creating a substantial transitive trust risk. Overall classification: SUSPICIOUS.

Confidence: 92%Severity: 66%
Audit Metadata
Analyzed At
Oct 29, 2026, 02:41 PM
Package URL
pkg:socket/skills-sh/fudesign2008%2Fopen-skills%2Fgit-release-finish%2F@3b82a614d9a96e259a310360d04c541d6d2896e9035ffebeb442f911b7671bc8