office-hours

Warn

Audited by Socket on Jul 7, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS. The core office-hours behavior is legitimate, but the skill's operational footprint is much broader than its stated design-doc purpose: it reads extensive local state, may modify repo files and commit them, and can send metadata/content to optional remote services through helper binaries, search, sync, and second-opinion tooling. This looks more like a full gstack agent bootstrap wrapper than a narrowly scoped brainstorming skill.

Confidence: 82%Severity: 63%
Audit Metadata
Analyzed At
Jul 7, 2026, 01:23 PM
Package URL
pkg:socket/skills-sh/jarmen423%2Fskills%2Foffice-hours%2F@732e937e719b990e3e01d20a77254248a272dad978b755e9804d0c2cb983ca96
Security Audit — socket — office-hours