skills/alvarovillalbaa/plugins/code-review/Socket

code-review

Warn

Audited by Socket on Jul 5, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the stated code-review purpose is coherent, but the skill expands scope by instructing transitive installation of multiple external skills through a local installer whose provenance and targets are not visible here. No direct credential theft or exfiltration is shown, so this is not confirmed malware, but it carries medium-high supply-chain and trust-chain risk.

Confidence: 84%Severity: 68%

Audit Metadata

Analyzed At

Jul 5, 2026, 04:25 PM

Package URL

pkg:socket/skills-sh/alvarovillalbaa%2Fplugins%2Fcode-review%2F@6a664125456f6b9ece784f15cddea7586aabfaf169cb19928b409cf387bb9625