skills/sprngr/rubber-duck/duck-review/Socket

duck-review

Warn

Audited by Socket on Jul 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS: the declared purpose is a lightweight code-review formatter, but the evidenced footprint expands into external CLI installation, credentialed remote review, and transitive skill installation. The vendor endpoints appear plausibly official, so this is not confirmed malware, but the capability and trust footprint are not proportionate to the stated skill purpose.

Confidence: 85%Severity: 72%

Audit Metadata

Analyzed At

Jul 17, 2026, 04:39 AM

Package URL

pkg:socket/skills-sh/sprngr%2Frubber-duck%2Fduck-review%2F@a9abe0fa48637220c19f5f3290f05620a134eb2f6f4db1ef1e65de3c80ff43b1