meta-tribe-skill

Warn

Audited by Socket on May 16, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/deploy_to_persistent.sh

This fragment is best characterized as a remote orchestration/deployment script with meaningful security and operational risk: it performs privileged remote Docker stop/remove of all containers, weakens SSH host authenticity checks (StrictHostKeyChecking=no), and injects HF_TOKEN into a remote container via an environment variable. No direct evidence of overt malware (e.g., reverse shell, clear exfiltration to third-party domains, or persistence) is visible in the provided code, but the combination of destructive remote actions and secret handling warrants careful review of target trust, SSH/network integrity, container image provenance, and logging practices.

Confidence: 66%Severity: 63%
Audit Metadata
Analyzed At
May 16, 2026, 12:37 AM
Package URL
pkg:socket/skills-sh/Varnan-Tech%2Fopendirectory%2Fmeta-tribe-skill%2F@18fcdbdc668aaea730031faed7c471331ea36b24
Security Audit — socket — meta-tribe-skill