skills/ruvnet/ruflo/iot-fleet/Socket

iot-fleet

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the capability matches the stated IoT fleet purpose, but the skill's entire function relies on executing an unpinned npm package at runtime via npx -y @latest. This is mainly a supply-chain and remote-action trust issue, with no direct evidence of credential theft or exfiltration in the skill text.

Confidence: 81%Severity: 64%

Audit Metadata

Analyzed At

Sep 15, 2026, 11:38 AM

Package URL

pkg:socket/skills-sh/ruvnet%2Fruflo%2Fiot-fleet%2F@8a70ad54e5eaee888c86703bf0eaef3040e98747960e1436bc9abc34157e1717