skills/howells/skills/xero/Socket

xero

Warn

Audited by Socket on Sep 5, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the stated purpose is coherent, but the trust model is not. The skill reads a local 1Password service-account token, injects Xero secrets, and executes a private personal repo plus npm dependencies with those credentials; that is disproportionate and creates a high credential-forwarding and supply-chain risk despite otherwise purposeful instructions.

Confidence: 90%Severity: 86%

Audit Metadata

Analyzed At

Sep 5, 2026, 07:04 AM

Package URL

pkg:socket/skills-sh/howells%2Fskills%2Fxero%2F@3e61cf2e096a5526b35ce9cab4ac39de143a700f713043c74aeae8b554d084b9