to-spec

Warn

Audited by Socket on Aug 21, 2026

1 alert found:

Anomaly
AnomalyLOW
SKILL.md

SUSPICIOUS: the core behavior is coherent for a spec-publishing skill, and install evidence suggests same-publisher tooling. Risk comes from transitive skill setup, external issue-tracker writes, and internal skill routing without explicit per-action safeguards, so it is not benign but also not malicious.

Confidence: 82%Severity: 56%
Audit Metadata
Analyzed At
Aug 21, 2026, 01:22 AM
Package URL
pkg:socket/skills-sh/tt-a1i%2Fmatt-skills-with-to-goal%2Fto-spec%2F@cd3cfb5b435d127fa5bfae924e54ab24f84f7dcdf02cb62a5db6d9e9a0c8b319
Security Audit — socket — to-spec