skills/llmquant/llmquant-hermes/portfolio-pulse/Socket

portfolio-pulse

Warn

Audited by Socket on Aug 12, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the core portfolio-monitoring behavior mostly matches the stated purpose, and the data flows appear centered on LLMQuant/Hermes rather than obvious attacker infrastructure. The main concerns are transitive skill installation, medium supply-chain trust from GitHub/third-party installer paths, and automated Telegram delivery of sensitive portfolio summaries.

Confidence: 84%Severity: 62%

Audit Metadata

Analyzed At

Aug 12, 2026, 09:28 PM

Package URL

pkg:socket/skills-sh/llmquant%2Fllmquant-hermes%2Fportfolio-pulse%2F@5d387c1a01773c5fdb35193bd6a6c2011fb9a7eedb1d2780839c0ca61a0830fd