autoskill
Warn
Audited by Socket on Sep 17, 2026
1 alert found:
AnomalyAnomalyscripts/promote.py
LOWAnomalyLOW
scripts/promote.py
No clear malicious behavior is present. The primary security issue is insufficient path validation: untrusted --name values can enable path traversal and, together with symlink resolution, cause directories outside the intended trees to be moved or targeted. Restrict name to a single safe directory name and verify resolved source and destination containment before moving.
Confidence: 98%Severity: 62%
Audit Metadata