fix-prose

Warn

Audited by Socket on Oct 11, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the purpose is coherent for prose-lint remediation, but the implementation is not proportionate because it executes a shell command at skill-load time with raw user arguments. The main risk is pre-execution command injection through $ARGUMENTS and caller-controlled lint commands, not overt malware or exfiltration.

Confidence: 93%Severity: 91%
Audit Metadata
Analyzed At
Oct 11, 2026, 05:24 AM
Package URL
pkg:socket/skills-sh/tbhb%2Fvale-ai-tells%2Ffix-prose%2F@39ebf1b2e3d317ab18cd5ee58de99a90ee0ddba6b8f36a53884140b89ee685fd