skills/podo/design-agent-skills/claude-pm-skills/Socket

claude-pm-skills

Warn

Audited by Socket on Jun 25, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The stub is not overtly malicious and uses an official CLI from npm, but its core behavior is transitive installation of a third-party GitHub skill from a personal repo with no pinning or release verification shown. The main risk is supply-chain and inherited-permission trust, not direct credential theft or confirmed malware.

Confidence: 90%Severity: 62%

Audit Metadata

Analyzed At

Jun 25, 2026, 06:34 PM

Package URL

pkg:socket/skills-sh/podo%2Fdesign-agent-skills%2Fclaude-pm-skills%2F@9ca21893a91aed836bdc09667afaf87ace8353e2a04697b33f161ee6dd821860