skills/tiangong-lca/skills/tiangong-lca-remote-ops/Socket

tiangong-lca-remote-ops

Warn

Audited by Socket on Apr 21, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the stated remote-ops purpose is coherent, but the trust chain is not. The skill requires an external `tiangong` CLI of unclear official provenance and forwards a sensitive API key to it, creating a high supply-chain and credential-forwarding risk even without direct evidence of malicious intent.

Confidence: 83%Severity: 84%

Audit Metadata

Analyzed At

Apr 21, 2026, 07:01 AM

Package URL

pkg:socket/skills-sh/tiangong-lca%2Fskills%2Ftiangong-lca-remote-ops%2F@c17f9990899ea5f9bbb1c01626895864bb2ab933