skills/tiagodanin/trunative/trunative-react-native/Socket

trunative-react-native

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The skill's stated purpose is benign and its local file access is proportionate, but it instructs execution of an unverified `trunative` CLI via `npx` without established official provenance. With no credential handling or exfiltration behavior shown, this is best classified as supply-chain risk rather than confirmed malware.

Confidence: 88%Severity: 78%

Audit Metadata

Analyzed At

Sep 17, 2026, 08:01 PM

Package URL

pkg:socket/skills-sh/tiagodanin%2Ftrunative%2Ftrunative-react-native%2F@816a59380e699f711ae7756e29b2474974f3355772968fcda65eaa219bd365f6