skills/jaechang-hits/scicraft/rowan/Socket

rowan

Warn

Audited by Socket on Jul 10, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's purpose and cloud-API behavior are broadly coherent, but the installation instructions are trust-critically inconsistent with Rowan's official SDK distribution. Telling users to `pip install rowan` risks installing an unrelated PyPI package, making this a medium/high supply-chain issue rather than confirmed malware.

Confidence: 92%Severity: 72%

Audit Metadata

Analyzed At

Jul 10, 2026, 03:37 PM

Package URL

pkg:socket/skills-sh/jaechang-hits%2Fscicraft%2Frowan%2F@2942514ccdf0745e7784b22a7698bcb766798deac485baa8ccc27d3e864d74e4