skills/gabelul/stitch-kit/stitch-setup/Socket

stitch-setup

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated purpose is coherent for a Stitch setup guide, and the primary API/data flow to `stitch.googleapis.com` looks legitimate. The main risk is supply-chain and transitive trust: it instructs users to execute third-party npm code and install a separate GitHub-hosted skill pack from different publishers, without establishing provenance in the skill itself.

Confidence: 84%Severity: 66%

Audit Metadata

Analyzed At

Sep 20, 2026, 09:03 PM

Package URL

pkg:socket/skills-sh/gabelul%2Fstitch-kit%2Fstitch-setup%2F@ccd7274eb9bc148a0f6b2be7f3111df02cd559d6ce1e1b036263a54b3c265065