skills/joelfrancisco/skills/publish-and-sync-skills/Socket

publish-and-sync-skills

Warn

Audited by Socket on Jul 30, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill’s stated purpose matches its GitHub and installation actions, but it instructs transitive global installation of skills from a personal repository using an unpinned npm CLI. That is coherent for a release workflow, yet the trust model is broad and risky because downstream skills gain execution influence across multiple harnesses without independent verification.

Confidence: 85%Severity: 72%

Audit Metadata

Analyzed At

Jul 30, 2026, 08:22 PM

Package URL

pkg:socket/skills-sh/JoelFrancisco%2Fskills%2Fpublish-and-sync-skills%2F@485fd26faac129e27c9ae502c6a9c7085cad9bee714bd0f509e4f23f61d57f17