skills/stahura/domo-ai-vibe-rules/code-engine-update/Socket

code-engine-update

Warn

Audited by Socket on Sep 16, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the workflow purpose is coherent for a Domo package-update skill, but its main execution path relies on an unverified community CLI with unclear publisher provenance and likely credential handling. No direct exfiltration or overtly malicious behavior is shown, yet the external CLI trust gap makes the skill high-risk to use as written.

Confidence: 85%Severity: 78%

Audit Metadata

Analyzed At

Sep 16, 2026, 06:15 PM

Package URL

pkg:socket/skills-sh/stahura%2Fdomo-ai-vibe-rules%2Fcode-engine-update%2F@297284852a7ed3b20ad58adecf0b49324e9d01fd21011679653f6d55c1e9aa4f