skills/tinh2/skills-hub-registry/permit-compliance/Socket

permit-compliance

Warn

Audited by Socket on Mar 23, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The core repo-review behavior is mostly coherent and local, with no installer, credential, or external API abuse. Risk comes from autonomous operation, a non-essential write into ~/.claude/projects/, and especially the recommendation to run an unverified slash command (/cost-overrun-predictor), which creates transitive trust beyond the stated permit-compliance review purpose.

Confidence: 87%Severity: 56%

Audit Metadata

Analyzed At

Mar 23, 2026, 11:04 AM

Package URL

pkg:socket/skills-sh/tinh2%2Fskills-hub-registry%2Fpermit-compliance%2F@e985a1d6aed96420b34cfd48351e3d25e32809a5