self-hosted-github-runner

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the skill's purpose is coherent, but its actual footprint is high-risk because it routes GitHub runner registration into a non-GitHub third-party container image and may run untrusted PR/dependency code with optional host-level Docker access. The main concern is credential forwarding and broad execution trust, not confirmed malware or covert exfiltration.

Confidence: 88%Severity: 82%
Audit Metadata
Analyzed At
Sep 20, 2026, 12:31 PM
Package URL
pkg:socket/skills-sh/uzysjung%2Fuzys-agent-harness%2Fself-hosted-github-runner%2F@cd4fb4ff9748c7a8107623eded42eb2afe1e82a98542732ba4375014ffd8ee14