skills/mvanhorn/printing-press-library/pp-wahoo/Socket

pp-wahoo

Warn

Audited by Socket on Jul 20, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's Wahoo-focused capabilities are mostly coherent, but it relies on externally installed third-party CLIs with unpinned runtime install paths and forwards OAuth secrets to them. The optional arbitrary webhook delivery materially increases data-exfiltration risk. This looks more like a high-risk, trust-heavy integration than confirmed malware.

Confidence: 82%Severity: 78%

Audit Metadata

Analyzed At

Jul 20, 2026, 11:00 PM

Package URL

pkg:socket/skills-sh/mvanhorn%2Fprinting-press-library%2Fpp-wahoo%2F@2e629fae47fda320575d2191ca1ac80799881a28618a47123e9a1ff3bf391bb6