skills/smashandclash/plugin/smash-and-clash-cli/Socket

smash-and-clash-cli

Warn

Audited by Socket on Oct 2, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the gameplay behavior is coherent with the stated purpose, but the install/execution trust is not. The skill asks the agent to run an unverifiable, unpinned third-party CLI from npm with no clear publisher provenance or documented official endpoints, which creates a high supply-chain risk even without direct credential handling.

Confidence: 84%Severity: 82%

Audit Metadata

Analyzed At

Oct 2, 2026, 06:15 PM

Package URL

pkg:socket/skills-sh/smashandclash%2Fplugin%2Fsmash-and-clash-cli%2F@a3a70128d10d8cae84168c305552ab14b65b720ab08cbc843bf087ddbbc4d773