dave
Warn
Audited by Socket on Sep 20, 2026
1 alert found:
AnomalyAnomalyreferences/roles/cartographer.md
LOWAnomalyLOW
references/roles/cartographer.md
This fragment is an operational prompt for installing and invoking a third-party diagramming skill. It contains a meaningful supply-chain risk because it requests an unpinned global installation from `tt-a1i/archify` and symlinks the result into multiple agent environments. No direct malware or data theft is visible in the supplied text, but the referenced skill must be audited before installation or execution. The assessment is limited because the implementation and call sites are not shown.
Confidence: 93%Severity: 58%
Audit Metadata