skills/gemini-cli-extensions/conductor/conductor-new-track/Socket

conductor-new-track

Warn

Audited by Socket on Jul 22, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the core planning and local file-management behavior is coherent, but the skill also installs additional agent skills from an unspecified remote URL via raw curl. That transitive skill installation and unverifiable source path are disproportionate trust risks for a planning skill, even without confirmed credential theft or payload execution.

Confidence: 89%Severity: 83%

Audit Metadata

Analyzed At

Jul 22, 2026, 02:32 PM

Package URL

pkg:socket/skills-sh/gemini-cli-extensions%2Fconductor%2Fconductor-new-track%2F@3c08985ade0b96ab88fa997fa5d9079c52e6b833eaf2a765b212d627def5f975