skills/hoangvantuan/substack-cli/sub-cli/Socket

sub-cli

Warn

Audited by Socket on Sep 26, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill’s capabilities fit a Substack management tool, but its trust model does not. It asks the agent to use a cookie-handling third-party CLI whose official provenance could not be verified, creating notable supply-chain and credential-forwarding risk despite otherwise coherent purpose and scoped instructions.

Confidence: 84%Severity: 74%

Audit Metadata

Analyzed At

Sep 26, 2026, 12:32 AM

Package URL

pkg:socket/skills-sh/hoangvantuan%2Fsubstack-cli%2Fsub-cli%2F@f9ac2117c8a79f9f836881597d0e9011666e4c27895c2cd25f375f3052e1c335