repomix-unmixer

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/unmix_repomix.py

The code is a file extraction utility with no clear malicious behavior, but it has a significant path traversal and arbitrary file overwrite risk because embedded paths are trusted. Treat repomix input as untrusted and validate that resolved output paths remain within the chosen output directory. The incomplete final main( also indicates a syntax error if present literally.

Confidence: 98%Severity: 70%
Audit Metadata
Analyzed At
Sep 15, 2026, 03:07 AM
Package URL
pkg:socket/skills-sh/daymade%2Fclaude-code-skills%2Frepomix-unmixer%2F@544bf9c859b144145c3ae227967d69ad3049eb4eedb6c2e4f29e4e65f7662c53