skills/konglong87/superpm/discover/Socket

discover

Warn

Audited by Socket on Sep 25, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s stated purpose is coherent, but it asks the agent to install additional skills from a third-party GitHub repository, shifting trust to unreviewed transitive dependencies. No direct credential harvesting, stealth, or exfiltration appears here, but the transitive install pattern and unpinned external source make this medium risk.

Confidence: 89%Severity: 56%

Audit Metadata

Analyzed At

Sep 25, 2026, 01:17 PM

Package URL

pkg:socket/skills-sh/konglong87%2Fsuperpm%2Fdiscover%2F@947b0361657d95104c407fdbbd41caf0bddcf31e06599b968536eee2e160b15e