advise-max

Warn

Audited by Socket on Sep 7, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The stated purpose matches side-by-side AI querying, and there is no clear malicious payload or credential theft behavior in the skill text. However, it depends on an insufficiently verified `researchkit` executable invoked through `uv run`, and it multiplexes user prompts/context through several external CLIs, creating meaningful supply-chain and data-spread risk disproportionate to a simple advice helper.

Confidence: 82%Severity: 74%
Audit Metadata
Analyzed At
Sep 7, 2026, 09:54 PM
Package URL
pkg:socket/skills-sh/paldom%2Fresearchkit%2Fadvise-max%2F@3b6d8fed7f41a2afb666e2a4772558cebf37c098372acc98b48cba80fcce7119