skills/malue-ai/dazee-small/bear-notes/Socket

bear-notes

Warn

Audited by Socket on Mar 28, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s purpose is coherent, and its data flow appears aimed at Bear’s local x-callback API, but it relies on an unrelated third-party CLI installed from a personal GitHub repo with an unpinned @latest version and forwards a Bear API token to that tool. This is a supply-chain and credential-handling risk rather than confirmed malware.

Confidence: 88%Severity: 64%

Audit Metadata

Analyzed At

Mar 28, 2026, 02:08 AM

Package URL

pkg:socket/skills-sh/malue-ai%2Fdazee-small%2Fbear-notes%2F@e82b08bf2ddf20d4224919283df7ec403e41374d