setup-tangram-remote-tool
Warn
Audited by Socket on Aug 24, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The local Tangram setup is broadly coherent, but the optional Connect path materially increases risk: it installs a direct wheel from an unverified domain relationship, forwards authentication to external platform services, and enables sharing a local tool externally. That footprint is plausible for a relay skill, yet the install provenance is not strong enough to treat as benign.
Confidence: 82%Severity: 76%
Audit Metadata