skills/obra/muse-skills/peloton/Socket

peloton

Warn

Audited by Socket on Oct 8, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's purpose is coherent, but it relies on an undocumented external `peloton` CLI that appears unverifiable and is entrusted with persistent OAuth tokens and account actions. The main risk is supply-chain and credential exposure through a black-box binary, not confirmed malicious behavior in the skill text itself.

Confidence: 85%Severity: 86%

Audit Metadata

Analyzed At

Oct 8, 2026, 11:46 PM

Package URL

pkg:socket/skills-sh/obra%2Fmuse-skills%2Fpeloton%2F@afd1b7b53ee71d04e3ac3973daa9d28ebcd8cb84e2fe3d1290e7c6374bb37492