skills/tsubasahonda/skills/claude-companion/Socket

claude-companion

Warn

Audited by Socket on Apr 16, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the basic purpose—delegating work to official local agent CLIs—is coherent, but the GLM mode materially changes data flow by routing prompts and a token-bearing config through third-party Z.AI. The permissive passthrough of tool permissions and temporary secret-on-disk handling make the skill higher risk than a simple local companion wrapper.

Confidence: 83%Severity: 72%

Audit Metadata

Analyzed At

Apr 16, 2026, 02:34 AM

Package URL

pkg:socket/skills-sh/tsubasahonda%2Fskills%2Fclaude-companion%2F@f91abaacdf92db631685795dedf58e663cbe8a31