subtitle-extractslator

Warn

Audited by Socket on Mar 31, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

The stated subtitle-processing purpose is mostly coherent, and OpenSubtitles usage fits that purpose. The main issue is install and trust: the skill requires execution of a GitHub-release binary that is the core runtime and appears to receive authentication and provider credentials, which triggers high supply-chain and credential-forwarding risk. Overall classification: SUSPICIOUS due to unverifiable binary trust and opaque external-provider routing, not confirmed malware.

Confidence: 83%Severity: 84%
Audit Metadata
Analyzed At
Mar 31, 2026, 02:28 PM
Package URL
pkg:socket/skills-sh/waynebaby%2FSubtitleExtractslator%2Fsubtitle-extractslator%2F@867106a8748d7249d48ae0b1f2a67708fec639a6
Security Audit — socket — subtitle-extractslator