skills/getsesame/skills/sesame-onboard/Socket

sesame-onboard

Warn

Audited by Socket on Jul 3, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill's main behavior matches its stated AWS onboarding purpose and shows good restraint around secrets, so it does not look malicious. However, it relies on a curl|sh installer with mutable/unpinned behavior, optional checksum skipping, and transitive skill installation, which makes the install and execution trust materially risky for an AI agent skill.

Confidence: 88%Severity: 64%

Audit Metadata

Analyzed At

Jul 3, 2026, 09:24 PM

Package URL

pkg:socket/skills-sh/getsesame%2Fskills%2Fsesame-onboard%2F@00dd25b2b3bf13da08f2d0c3d8bef4845b1748be9d30d04e2a77fb96ab1cda1e