skills/mims-harvard/tooluniverse/tooluniverse-install-skills/Socket

tooluniverse-install-skills

Warn

Audited by Socket on Sep 16, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated purpose matches the behavior, and the source repo appears to be the publisher's official ToolUniverse repository, so this is not confirmed malware. However, it performs transitive skill installation from an unpinned GitHub clone and manually copies many skills into local agent directories, which creates medium supply-chain and trust-chain risk beyond a simple verifier.

Confidence: 90%Severity: 52%

Audit Metadata

Analyzed At

Sep 16, 2026, 06:33 AM

Package URL

pkg:socket/skills-sh/mims-harvard%2Ftooluniverse%2Ftooluniverse-install-skills%2F@339772d3b1fa7a74813dc9ee24800055cad5916085dc4e178527ee306d9ff536