skills/marcellocurto/skills/pr-comments-audit/Socket

pr-comments-audit

Warn

Audited by Socket on Oct 5, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the skill's purpose matches PR review workflows, but it explicitly authorizes autonomous external actions—pushing code and posting/resolving PR comments—without approval. No malicious installer or obvious exfiltration path is shown, yet the hidden helper script and lack of data-flow detail keep risk elevated.

Confidence: 84%Severity: 72%

Audit Metadata

Analyzed At

Oct 5, 2026, 06:05 AM

Package URL

pkg:socket/skills-sh/marcellocurto%2Fskills%2Fpr-comments-audit%2F@bddd2adcd32c066d350ad965e70d08ec6fc1ef1e57847001769f704e3a68b38b