ce-code-review

Warn

Audited by Socket on Nov 12, 2026

1 alert found:

Security
SecurityMEDIUM
references/cross-model-review.md

This fragment is documentation that instructs an agent to send reviewed code and a semantic review brief to a configured external model provider, then merge returned findings. Its fixed-route, read-only, and opt-out safeguards are stated but cannot be verified because the referenced scripts are not provided. The principal risk is potentially sensitive source-code disclosure, with additional concern that the text encourages dispatch and possible command escalation under its own authorization rules. Severity is medium to high if executed on sensitive repositories; no specific provider URL, domain, IP, or targeted credentials are present.

Confidence: 96%Severity: 72%
Audit Metadata
Analyzed At
Nov 12, 2026, 03:29 PM
Package URL
pkg:socket/skills-sh/everyinc%2Fcompound-engineering-plugin%2Fce-code-review%2F@52e61fbb1fccc0573b21cfea58382f178fc2a2f6896c1d0fef45ee3c5eb82c26