pr-naming

Warn

Audited by Socket on Sep 1, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/check_pr.py

No direct evidence of malware such as exfiltration, persistence, or cryptomining is present in this snippet. However, the module includes high-risk security anti-patterns: dynamic eval for regex compilation and, more critically, a command injection-prone subprocess call using shell=True with untrusted branch_name interpolated into a shell command. This makes the code potentially dangerous when executed with attacker-controlled arguments, despite its apparent intent as a formatting checker.

Confidence: 80%Severity: 80%
Audit Metadata
Analyzed At
Sep 1, 2026, 11:06 AM
Package URL
pkg:socket/skills-sh/aws-samples%2Fsample-agent-skill-eval%2Fpr-naming%2F@84d5478d43573a00f1b374999953b604ed5605f9f939dfed3a2a0e133f7ae4bb
Security Audit — socket — pr-naming