skills/milkywayrules/verasic-skills/verasic-github-governance-init/Socket

verasic-github-governance-init

Warn

Audited by Socket on Oct 2, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated purpose matches repo-governance bootstrap actions, but the skill expands trust through transitive skill installation and local shell-script execution from a personal GitHub publisher. The main concerns are supply-chain and remote-action scope, not confirmed malicious behavior.

Confidence: 86%Severity: 63%

Audit Metadata

Analyzed At

Oct 2, 2026, 01:01 PM

Package URL

pkg:socket/skills-sh/milkywayrules%2Fverasic-skills%2Fverasic-github-governance-init%2F@7313f9ff3741d37f6e6b0a82b1625e2182a21e30c728c8797e6f21d0a1f01ca3