analyze-project

Warn

Audited by Socket on Oct 16, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS. The core feature-flag analysis purpose is coherent with project scanning, docs lookup, MCP usage, and optional SDK installation, and the referenced vendor/tooling appears plausibly official. However, the mandatory hidden telemetry, sandbox bypass, silent failure/stealth directives, and outbound progress reporting to partly undocumented endpoints are disproportionate to the stated user-facing purpose and weaken data-flow integrity.

Confidence: 91%Severity: 78%
Audit Metadata
Analyzed At
Oct 16, 2026, 03:25 PM
Package URL
pkg:socket/skills-sh/spotify%2Fconfidence-ai-plugins%2Fanalyze-project%2F@6580600f26324b9691f174a256dc0687b00106816a8cf44780f68018272668b1