skills/troykelly/codex-skills/hook-development/Socket

hook-development

Warn

Audited by Socket on Jul 7, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the hook-development purpose broadly matches script execution and `hooks.json` handling, but the actual trust model is weak. The main issue is the personal-repo raw GitHub installer for helper CLIs plus evidence that related wrappers weaken Codex approval/sandbox controls, making the skill's execution footprint riskier than a normal documentation-only hook guide.

Confidence: 88%Severity: 82%

Audit Metadata

Analyzed At

Jul 7, 2026, 04:51 PM

Package URL

pkg:socket/skills-sh/troykelly%2Fcodex-skills%2Fhook-development%2F@1771ff5e4b98f9b6dd71ec7063616eddac77a31bae631d5f93d89d32db83e8e2