skills/everyinc/compound-engineering-plugin/resolve-pr-feedback/Socket

resolve-pr-feedback

Warn

Audited by Socket on Apr 17, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: The skill is broadly aligned with its stated PR-feedback purpose and uses official GitHub flows, but it grants high-impact autonomous write actions (commit/push/comment/resolve) and processes untrusted PR text while spawning downstream agents. The main concern is operational risk and transitive agent trust, not malware or credential theft.

Confidence: 87%Severity: 62%

Audit Metadata

Analyzed At

Apr 17, 2026, 05:51 AM

Package URL

pkg:socket/skills-sh/everyinc%2Fcompound-engineering-plugin%2Fresolve-pr-feedback%2F@e6cbe7b0a957c83f7a6956d2f1e6b6916749a502