skills/magnus919/agent-skills/github-runner/Socket

github-runner

Warn

Audited by Socket on Sep 2, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill’s overall purpose is legitimate and mostly supported by official GitHub documentation, but it normalizes use of a third-party runner container that receives GitHub PATs/tokens. That supply-chain plus credential-forwarding combination is not fully proportionate to a documentation skill and weakens trust even without direct evidence of exfiltration.

Confidence: 89%Severity: 74%

Audit Metadata

Analyzed At

Sep 2, 2026, 05:57 PM

Package URL

pkg:socket/skills-sh/magnus919%2Fagent-skills%2Fgithub-runner%2F@a3d2cbede75f05dfef24ed667d5291793f7c7fa9debccca3c2308396ca903f94