skills/yarn-rp/stask/stask-lead/Socket

stask-lead

Warn

Audited by Socket on Apr 11, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The workflow purpose is coherent, but its core dependency is an unverifiable remote CLI executed via unpinned `npx`, which materially elevates supply-chain risk. The skill also grants the agent autonomous Slack/GitHub/task-management actions and processes untrusted external review content, making it high-risk even without evidence of confirmed malicious intent.

Confidence: 85%Severity: 83%

Audit Metadata

Analyzed At

Apr 11, 2026, 04:17 PM

Package URL

pkg:socket/skills-sh/yarn-rp%2Fstask%2Fstask-lead%2F@cdf6c64c6d1b8d838ef7f627585d30db0f0abe9d