dave

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Anomaly
AnomalyLOW
references/roles/cartographer.md

This fragment is an operational prompt for installing and invoking a third-party diagramming skill. It contains a meaningful supply-chain risk because it requests an unpinned global installation from `tt-a1i/archify` and symlinks the result into multiple agent environments. No direct malware or data theft is visible in the supplied text, but the referenced skill must be audited before installation or execution. The assessment is limited because the implementation and call sites are not shown.

Confidence: 93%Severity: 58%
Audit Metadata
Analyzed At
Sep 20, 2026, 05:46 AM
Package URL
pkg:socket/skills-sh/thesawdawg%2Fagent-skills%2Fdave%2F@51c9255f0bb6bf2f2422a969ca5393a02c509645387234441c729156fa3945bc