skills/whizzzkid/skills/wk-pr-takeover/Socket

wk-pr-takeover

Warn

Audited by Socket on Aug 19, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS. The core GitHub and git capabilities fit the stated PR-takeover purpose, and data flows stay mostly within official GitHub tooling. The main concerns are transitive skill capability via `npx skills`, autonomous PR-modifying actions, and prompt-injection risk from consuming untrusted PR content while also having command execution and write access.

Confidence: 86%Severity: 58%

Audit Metadata

Analyzed At

Aug 19, 2026, 04:33 AM

Package URL

pkg:socket/skills-sh/whizzzkid%2Fskills%2Fwk-pr-takeover%2F@fd03446223a7510f6c36a2e76670a318b1b49997c8afcaaa5ef0b1a68572bb7e