skills/kentcdodds/kcd-skills/ship-pr/Socket

ship-pr

Warn

Audited by Socket on Oct 29, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill's behavior mostly matches its PR-shepherding purpose and uses official Kody/GitHub channels, but it relies on unpinned npx execution and a third-party Kody package explicitly marked for user verification. This is not confirmed malware, yet the transitive supply-chain trust and autonomous merge/reply actions make it a medium-risk skill.

Confidence: 85%Severity: 52%

Audit Metadata

Analyzed At

Oct 29, 2026, 07:40 PM

Package URL

pkg:socket/skills-sh/kentcdodds%2Fkcd-skills%2Fship-pr%2F@2fa57b3312016f7632e3603a3cf8c76120f7c6e17adefaba0aa3fb770deafbf0