retro

Warn

Audited by Socket on Jul 15, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The retrospective behavior is mostly aligned with the stated purpose, and there is no clear credential harvesting or malicious exfiltration in the skill text. However, it relies on same-org local helper binaries with no verifiable release/signing trail, performs substantial preamble execution, and forwards usage events through publisher tooling, which makes the install/execution trust footprint larger than a simple git-analysis skill.

Confidence: 84%Severity: 72%
Audit Metadata
Analyzed At
Jul 15, 2026, 12:55 PM
Package URL
pkg:socket/skills-sh/Lua2147%2Fclaude-toolkit-catalog%2Fretro%2F@5033c6ddfb8390d993d1ece1394e13b51488b288218ca3b219874a7acb4f14c2
Security Audit — socket — retro