lifecycleinventory-review

Warn

Audited by Socket on May 17, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: The skill's review behavior and data flows are largely coherent with its stated TianGong audit purpose, and there is no sign of credential theft, proxy routing, or covert exfiltration. The main issue is install/execution trust: it relies on an unverified local `tiangong` binary whose official source and release chain could not be confirmed, which forces a high security-risk classification under the required scoring rules.

Confidence: 82%Severity: 72%
Audit Metadata
Analyzed At
May 17, 2026, 06:58 AM
Package URL
pkg:socket/skills-sh/tiangong-lca%2Fskills%2Flifecycleinventory-review%2F@8ff186d84258d1557d7d042a4152972478b323d1
Security Audit — socket — lifecycleinventory-review