plan-it
Warn
Audited by Socket on Sep 5, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS. The planning purpose is mostly coherent, and the Vercel design-doc fetch is proportionate, but the full-plan workflow depends on executing a non-verified GitHub fork/branch of `lavish-axi` via `npx`. That install/execute path is inconsistent with the publicly documented package source and creates significant supply-chain risk; transitive installation of the `lavish` skill adds further trust expansion.
Confidence: 90%Severity: 82%
Audit Metadata