autoskill

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/promote.py

No clear malicious behavior is present. The primary security issue is insufficient path validation: untrusted --name values can enable path traversal and, together with symlink resolution, cause directories outside the intended trees to be moved or targeted. Restrict name to a single safe directory name and verify resolved source and destination containment before moving.

Confidence: 98%Severity: 62%
Audit Metadata
Analyzed At
Sep 17, 2026, 01:30 PM
Package URL
pkg:socket/skills-sh/crazymsn%2Facademic-skills%2Fautoskill%2F@15e8527d385a507d980a96023f8e57c2c389052cb4c8e46d6e533192eebb37fd