skills/qwenlm/qwen-code-examples/auto-pr/Socket

auto-pr

Warn

Audited by Socket on Sep 29, 2026

1 alert found:

Anomaly

Anomalyscripts/create-pr.js

LOW

AnomalyLOW

scripts/create-pr.js

No clear malware behavior is present. The intended PR automation is apparent, but interpolating untrusted values into `execSync` shell commands creates command-injection vulnerabilities. Use `spawn`/`execFile` with argument arrays or safely validate and quote every value.

Confidence: 98%Severity: 62%

Audit Metadata

Analyzed At

Sep 29, 2026, 10:33 PM

Package URL

pkg:socket/skills-sh/qwenlm%2Fqwen-code-examples%2Fauto-pr%2F@223f1b246654c81876cc9709ca5f52705c4a98650402de44f51e965850e6b8a6