skills/github/spec-kit-copilot/speckit-workflow/Socket

speckit-workflow

Warn

Audited by Socket on Sep 4, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s purpose and core commands are coherent with workflow management, and the primary CLI appears to be an official same-org tool. The main risk is proportional but real: it enables adding catalogs and workflows from arbitrary URLs, then executing workflow-defined steps via the CLI, plus it relies on a separate setup skill for installation trust.

Confidence: 86%Severity: 58%

Audit Metadata

Analyzed At

Sep 4, 2026, 11:43 PM

Package URL

pkg:socket/skills-sh/github%2Fspec-kit-copilot%2Fspeckit-workflow%2F@ddc06a96775669f669f6b59406c845d4b50e861e2c17fafbc87e469043523b05