yufan-Agnes

Warn

Audited by Socket on Jun 2, 2026

1 alert found:

Anomaly
AnomalyLOW
bridge/src/deps.js

This module is primarily an installer helper for the `cloudflared` binary. It does not show clear malicious intent (no evidence of data theft, persistence, or covert execution). The main security concern is that it can automatically perform privileged, high-impact system changes—especially on Linux—by executing shell-based commands that download remote signing material/repo configuration and run package manager installs (gated only by `options.install`, which defaults to enabled). This should be reviewed and executed in a context where installation side effects and supply-chain trust are acceptable.

Confidence: 70%Severity: 52%
Audit Metadata
Analyzed At
Jun 2, 2026, 12:47 PM
Package URL
pkg:socket/skills-sh/pjf6568%2Fyufan-agnes-skill%2Fyufan-agnes%2F@6b7be11a5322b04a8ed9bef68388d273529f7a90
Security Audit — socket — yufan-Agnes