signwell-automation
Warn
Audited by Socket on Jun 19, 2026
1 alert found:
AnomalyAnomalySKILL.md
LOWAnomalyLOW
SKILL.md
SUSPICIOUS: the stated purpose matches Signwell automation, but the skill relies on a discontinued Rube MCP endpoint, routes actions and auth through a Composio intermediary, and includes broader remote-workbench capability than necessary. This looks more like stale/overbroad integration guidance than confirmed malware, but the trust and data-flow model is not cleanly aligned or fully transparent.
Confidence: 84%Severity: 64%
Audit Metadata