skills/fellowship-dev/dogfooded-skills/post-deploy/Socket

post-deploy

Warn

Audited by Socket on Apr 26, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the skill’s core behavior fits a post-deploy automation purpose, and its visible network/data flows stay with expected services (GitHub, possibly AWS ECR). Risk comes from autonomous execution and especially the team-configured `custom` shell action, which lets repo/team configuration drive arbitrary commands with Bash and Write access.

Confidence: 84%Severity: 68%

Audit Metadata

Analyzed At

Apr 26, 2026, 07:54 PM

Package URL

pkg:socket/skills-sh/fellowship-dev%2Fdogfooded-skills%2Fpost-deploy%2F@071476f4aa502530a19b7fe4becfd2426c6f862a