skills/jackchuka/skills/gh-oss-go-bump/Socket

gh-oss-go-bump

Warn

Audited by Socket on Apr 15, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The skill is broadly aligned with its stated purpose, and its GitHub/Go data flows are mostly proportionate. The main risks are the unpinned third-party gh extension dependency, multi-repo write/merge capability, and moderate prompt-injection exposure from untrusted repo/web content combined with command execution. Not malicious, but medium risk.

Confidence: 85%Severity: 57%

Audit Metadata

Analyzed At

Apr 15, 2026, 02:46 AM

Package URL

pkg:socket/skills-sh/jackchuka%2Fskills%2Fgh-oss-go-bump%2F@c38754040dad206002b560a42e07c6f1a30e4ff9