skills/jd-solanki/skills/update-project-skills/Socket

update-project-skills

Warn

Audited by Socket on Aug 27, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill’s behavior mostly matches its stated purpose, and the CLI provenance appears official, but it still executes an unpinned `npx @latest` package and performs transitive upstream skill updates across repositories before auto-committing local changes. This is a moderate supply-chain and trust-chain risk, not confirmed malware.

Confidence: 87%Severity: 58%

Audit Metadata

Analyzed At

Aug 27, 2026, 03:24 PM

Package URL

pkg:socket/skills-sh/jd-solanki%2Fskills%2Fupdate-project-skills%2F@d58bdbf306ba9c8c0bd1ad00587fa2b8d89203b9d5eec1e3e48776644baf84b3