skills/shhac/agent-skills/agent-code-review/Socket

agent-code-review

Warn

Audited by Socket on Sep 23, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The workflow is coherent for automated PR review, and the named supporting tools map to official ecosystems, but the central `agent-code-review` binary itself is an unverifiable black box from the skill’s perspective. It also automates public GitHub actions, so the overall risk is high even without clear exfiltration behavior.

Confidence: 89%Severity: 78%

Audit Metadata

Analyzed At

Sep 23, 2026, 09:34 AM

Package URL

pkg:socket/skills-sh/shhac%2Fagent-skills%2Fagent-code-review%2F@d11329b5ff239c6ef10af01746987dc956ebe4b7624a14a13c59ec7534781b76