skill-maker
Warn
Audited by Socket on Nov 1, 2026
1 alert found:
AnomalyAnomalyscripts/refresh_skills.py
LOWAnomalyLOW
scripts/refresh_skills.py
The code is a skill-refresh utility. Its main supply-chain exposure is executing the mutable `skills@latest` npm package and publishing its staged output with user privileges. The fragment contains validation and does not itself show malicious behavior, but installer/package integrity is not pinned here.
Confidence: 94%Severity: 56%
Audit Metadata