skills/pedroromeroluna/ai-first-product-skills/product-builder-resolver/Socket

product-builder-resolver

Warn

Audited by Socket on Aug 12, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the resolver’s stated purpose is coherent, but it introduces a transitive trust chain by directing installation of a third-party remote skill pack via an unpinned `npx skills add` command. No direct credential theft or exfiltration is present, so this is mainly a supply-chain and trust-boundary risk rather than malware.

Confidence: 87%Severity: 60%

Audit Metadata

Analyzed At

Aug 12, 2026, 01:49 AM

Package URL

pkg:socket/skills-sh/pedroromeroluna%2Fai-first-product-skills%2Fproduct-builder-resolver%2F@bc4ae243d3f4d15d1e0729a77b86ff52b8159a44e9341dc23bd555d453746968