skills/win4r/museai-skills/peloton/Socket

peloton

Warn

Audited by Socket on Oct 25, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

Suspicious rather than clearly malicious. The skill's purpose is coherent, but it delegates all OAuth and account actions to an unverifiable external CLI that stores persistent Peloton tokens, making install trust and data flow integrity weak.

Confidence: 87%Severity: 84%

Audit Metadata

Analyzed At

Oct 25, 2026, 01:36 PM

Package URL

pkg:socket/skills-sh/win4r%2Fmuseai-skills%2Fpeloton%2F@abf855c9cf165f4f1b2460e659dadeb1f83e89ef486f2bcf299bbb5119a7a3b2