skills/opensearch-project/opensearch-agent-skills/opensearch-skills/Socket

opensearch-skills

Warn

Audited by Socket on May 19, 2026

1 alert found:

Anomaly

Anomalyobservability/log-analytics/SKILL.md

LOW

AnomalyLOW

observability/log-analytics/SKILL.md

SUSPICIOUS. The core purpose is coherent with the capabilities, and the main OpenSearch MCP package appears to be an official same-org tool with good provenance. However, the skill expands trust to external MCP servers, uses mutable `@latest`, forwards credentials to a helper process, and includes a configuration example that disables TLS verification. These issues make it medium risk rather than benign.

Confidence: 90%Severity: 58%

Audit Metadata

Analyzed At

May 19, 2026, 10:11 PM

Package URL

pkg:socket/skills-sh/opensearch-project%2Fopensearch-agent-skills%2Fopensearch-skills%2F@bdbcee6dff78ce8a7fa8e55c92a0e344f17473c3