skills/pedroromeroluna/ai-first-product-skills/product-builder-resolver/Socket

product-builder-resolver

Warn

Audited by Socket on Oct 21, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill's stated purpose as a resolver is coherent, and the `skills` CLI itself appears to be the official documented tool, so this is not malware. However, it directs the agent to install and trust a third-party skill pack from a personal repository, which expands trust beyond the resolver and is a meaningful transitive-supply-chain risk.

Confidence: 91%Severity: 56%

Audit Metadata

Analyzed At

Oct 21, 2026, 02:52 PM

Package URL

pkg:socket/skills-sh/pedroromeroluna%2Fai-first-product-skills%2Fproduct-builder-resolver%2F@9f816a266a1ab356e2b81d1bc5b47db45787a06914170ae620383479c282ef57