skills/johnefemer/skillfish/cpo-advisor/Socket

cpo-advisor

Warn

Audited by Socket on Jun 18, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The stated purpose is coherent and there is no evidence of credential harvesting or exfiltration, but the install trust is weaker than ideal because the skill is distributed as a third-party downloadable ZIP without visible verification, and the referenced local Python scripts were not provided for review.

Confidence: 81%Severity: 58%

Audit Metadata

Analyzed At

Jun 18, 2026, 10:54 AM

Package URL

pkg:socket/skills-sh/johnefemer%2Fskillfish%2Fcpo-advisor%2F@393e010b6008ec21b6b12d8fc95fae0cf6107aa6b8d44fd051a1adef9686fd5e