skills/pp-namias/portfolio/opencode-optimization/Socket

opencode-optimization

Warn

Audited by Socket on Jul 20, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The skill’s purpose is mostly consistent with IDE/MCP setup, but it normalizes unpinned `npx -y ...@latest` execution and credential forwarding to npm-fetched MCP server code. Data flows appear aligned with official services and same-brand packages rather than clear exfiltration, so this is not confirmed malware, but the install trust and credential exposure are medium risk.

Confidence: 85%Severity: 57%

Audit Metadata

Analyzed At

Jul 20, 2026, 02:19 PM

Package URL

pkg:socket/skills-sh/PP-Namias%2FPortfolio%2Fopencode-optimization%2F@fff2847238d46470a8373965829dd6d12689e4e65950dc6a9499475171f2ca05