skills/gooseworks-ai/goose-skills/lead-enrichment/Socket

lead-enrichment

Warn

Audited by Socket on Jun 23, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s lead-enrichment purpose is plausible, but its actual data flow is a proxy pattern that sends contact data and auth tokens through Gooseworks rather than official provider endpoints. Credential-file reading and an overridable API base add moderate risk, while the same-org `npx` install path appears legitimate but still unpinned.

Confidence: 88%Severity: 68%

Audit Metadata

Analyzed At

Jun 23, 2026, 02:15 PM

Package URL

pkg:socket/skills-sh/gooseworks-ai%2Fgoose-skills%2Flead-enrichment%2F@ed5bc3c6a12cfdd7c9f0dd71de555f09b84b8086a1757ba34eecd519d019f8c8