skills/niekcandaele/skills/review-pr/Socket

review-pr

Warn

Audited by Socket on Aug 7, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The skill's purpose is coherent and it uses official GitHub/GitLab tooling, but it reviews untrusted external PR content while holding Bash and Skill capabilities and automatically checks out the PR branch. That makes indirect prompt injection and downstream execution on attacker-controlled code the main risks; this is risky by design rather than overtly malicious.

Confidence: 88%Severity: 67%

Audit Metadata

Analyzed At

Aug 7, 2026, 07:20 AM

Package URL

pkg:socket/skills-sh/niekcandaele%2Fskills%2Freview-pr%2F@2a7fa83776ecefd04e415a88daa386caec37b7cb6b2562ec70985f27599fa05b