Warn
Audited by Socket on Jul 16, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The stated mailbox purpose is coherent, but the skill delegates every meaningful action to an unverifiable local `levmail` binary with no confirmed publisher, registry, or release provenance. There is no direct evidence of malware or credential theft in the skill text, yet the opaque executable creates a high trust and potential data-flow risk disproportionate to the minimal wrapper.
Confidence: 87%Severity: 82%
Audit Metadata