receipts

Warn

Audited by Socket on Jul 16, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the stated purpose is plausible, but the skill achieves it by running an external local script at load time via pre-execution syntax. That script lives outside the reviewed skill, has no verifiable provenance in the provided evidence, and runs before normal review, making the skill high-risk despite no confirmed exfiltration or remote download in the visible content.

Confidence: 84%Severity: 78%
Audit Metadata
Analyzed At
Jul 16, 2026, 03:50 PM
Package URL
pkg:socket/skills-sh/karanb192%2Fclaude-code-hooks%2Freceipts%2F@2ac1124d884462942bd87299c79c7e20a284baeffdac405138d8533cbf9171bf
Security Audit — socket — receipts