skills/vm0-ai/vm0-skills/bentolabs-ai/Socket

bentolabs-ai

Warn

Audited by Socket on Jun 30, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

The skill is narrowly scoped to BentoLabs API usage, but its trust chain is inconsistent: it asks users to source the API key from app.vm0.ai rather than a clearly verified bentolabs.ai-controlled flow. That makes the skill suspicious on data-flow integrity grounds, though not overtly malicious.

Confidence: 84%Severity: 62%

Audit Metadata

Analyzed At

Jun 30, 2026, 07:15 AM

Package URL

pkg:socket/skills-sh/vm0-ai%2Fvm0-skills%2Fbentolabs-ai%2F@b3a9998daa733fa6ec18185b71eee0ad05226f85714815b76f98152a2ac99def