skills/mvanhorn/printing-press-library/pp-morgen/Socket

pp-morgen

Warn

Audited by Socket on Jul 20, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: mostly coherent third-party Morgen CLI skill with verifiable same-publisher install sources and proportionate API auth, but medium risk due to unpinned third-party binary installation, optional MCP transitive trust, and arbitrary webhook output delivery that can exfiltrate calendar/task data.

Confidence: 85%Severity: 61%

Audit Metadata

Analyzed At

Jul 20, 2026, 11:01 PM

Package URL

pkg:socket/skills-sh/mvanhorn%2Fprinting-press-library%2Fpp-morgen%2F@b962e0302bc4a15db0e96ddac0b1a269926f02975dc34716df388f710d7fea10