skills/iwanhe/pandawa/product-skills/Socket

product-skills

Warn

Audited by Socket on Sep 4, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s stated purpose is benign and mostly aligned with local product/UX workflows, but its recommended installation relies on an unpinned third-party npm CLI from a different publisher, creating medium supply-chain and transitive-trust risk. No direct credential harvesting or malicious data flow is evident in the provided content.

Confidence: 85%Severity: 58%

Audit Metadata

Analyzed At

Sep 4, 2026, 02:34 PM

Package URL

pkg:socket/skills-sh/iwanhe%2Fpandawa%2Fproduct-skills%2F@15e186a2a169fc762719216ef139db3f13494476b239f4b4ee5289a8116f3b54