enter-merge-queue
Audited by Socket on Mar 9, 2026
1 alert found:
Obfuscated FileThe skill is largely coherent with its stated purpose of managing a PR through the merge queue and handling reviews, CI, and post-merge tasks. However, the footprint includes high automation that can alter repository state (rebases, force-pushes, enabling auto-merge) and continuous looping without explicit per-action user confirmation. This creates a suspicious level of operational reach for an agent, especially given the potential for input-driven misbehavior or unintended side effects in complex PR scenarios. Overall verdict: SUSPICIOUS. The capabilities align with the goal of automated PR merge management, but the risk surface from automated, multi-step shell and git operations, loop persistence, and heavy integration with external services warrants caution and closer containment/or explicit human-triggered gates before deployment in a production environment.