skills/ycmjason/tixmd/tixmd-next/Socket

tixmd-next

Warn

Audited by Socket on Mar 22, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s purpose is coherent for ticket orchestration, but it relies on unverified remote CLI execution via `pnpx @tixmd/cli` and lets repository markdown drive subsequent code changes. Main concern is supply-chain/install trust plus moderate prompt-injection risk from project files, not confirmed malware.

Confidence: 80%Severity: 68%

Audit Metadata

Analyzed At

Mar 22, 2026, 05:34 PM

Package URL

pkg:socket/skills-sh/ycmjason%2Ftixmd%2Ftixmd-next%2F@1765ddc2d21e8f4fc45fefa732d766183b4d3287