cli-hub-meta-skill
Warn
Audited by Socket on Apr 15, 2026
1 alert found:
SecuritySecuritySKILL.md
MEDIUMSecurityMEDIUM
SKILL.md
SUSPICIOUS: the skill’s purpose as a broad CLI marketplace is real, but its footprint is too open-ended for a single skill. The main risk is transitive trust: a live remote catalog plus unpinned git installs lets changing external content determine what code the agent installs and runs.
Confidence: 85%Severity: 74%
Audit Metadata