ps-poteto-mode

Warn

Audited by Socket on Sep 17, 2026

2 alerts found:

Securityx2
SecurityMEDIUM
playbooks/autopilot-full.md

The supplied material is an automation and governance playbook, not malware or executable code. It contains no direct malicious payload, secret harvesting, exfiltration, or sabotage logic. However, it creates a high-impact operational security risk by delegating repository writes and merges to cloud agents and external skills, with behavior partly controlled by mutable playbooks and optional CLI tooling. Use only with tightly scoped credentials, immutable reviewed tooling, branch protection, independent merge authorization, and separate review of all referenced skills and playbooks.

Confidence: 93%Severity: 72%
SecurityMEDIUM
playbooks/worktree-cleanup.md

No malware or covert data-theft behavior is present because the fragment is an explicit cleanup playbook rather than executable package code. It presents a significant operational data-loss risk through forceful worktree, simulator, runtime, application-state, and cache deletion. Execution should require independent path validation, explicit confirmation for every non-clean or uncertain item, and avoidance of `rm -rf` unless the exact surviving path is verified.

Confidence: 98%Severity: 78%
Audit Metadata
Analyzed At
Sep 17, 2026, 10:59 PM
Package URL
pkg:socket/skills-sh/pedroknigge%2Fpstack-skills%2Fps-poteto-mode%2F@6beb012543a120526b2575157e43b5ed16ce78e15ed7b7b3237565934d858870