skills/oyi77/1ai-skills/trendradar/Socket

trendradar

Warn

Audited by Socket on Jul 31, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: The skill’s purpose is plausible, but its actual execution path is not fully aligned with the cited upstream project. The main issue is an unverifiable `npx -y` MCP package that receives an API key, plus transitive trust into other skills/tools. This is better classified as high supply-chain and credential-forwarding risk rather than confirmed malware.

Confidence: 86%Severity: 84%

Audit Metadata

Analyzed At

Jul 31, 2026, 11:23 AM

Package URL

pkg:socket/skills-sh/oyi77%2F1ai-skills%2Ftrendradar%2F@9a23fbfc7f22fc2f266bfb215fc41a7f2b01bba339b9f87fae080060dab29c09