skills/milkywayrules/verasic-skills/verasic-github-governance-init/Socket

verasic-github-governance-init

Warn

Audited by Socket on Jul 28, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated purpose matches repo-governance bootstrap actions, but the skill expands trust through transitive skill installation and local shell-script execution from a personal GitHub publisher. The main concerns are supply-chain and remote-action scope, not confirmed malicious behavior.

Confidence: 86%Severity: 63%

Audit Metadata

Analyzed At

Jul 28, 2026, 06:47 PM

Package URL

pkg:socket/skills-sh/Milkywayrules%2Fverasic-skills%2Fverasic-github-governance-init%2F@b4cfb49d6c8f0adce05d14a76a21d52b13418d7bf0ee57e43dad216260be8c72