skills/lanej/dotfiles/conform/Socket

conform

Warn

Audited by Socket on Mar 28, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The stated purpose is coherent, but the skill’s core dependency is an unverifiable `conform` CLI with no disclosed provenance while it is entrusted with sensitive documents and Google cloud credentials. Official third-party tools mentioned are normal, but the missing trust chain for the main executable and its access to external AI services make the overall skill high risk.

Confidence: 88%Severity: 84%

Audit Metadata

Analyzed At

Mar 28, 2026, 07:27 PM

Package URL

pkg:socket/skills-sh/lanej%2Fdotfiles%2Fconform%2F@653917e0060e13b29ccef30c3bd06016b405b141