codebase-doctor
Warn
Audited by Socket on Sep 29, 2026
1 alert found:
AnomalyAnomalyevals/fixtures/build-fixtures.sh
LOWAnomalyLOW
evals/fixtures/build-fixtures.sh
The fragment is primarily a fixture-generation script that writes and commits example applications. It contains no clear malware behavior in the generator itself, but it deliberately generates payment code with an unsigned webhook and non-atomic stock updates, and a separate example logs email PII. The recursive deletion operations warrant care because their paths depend on $OUT. Treat the generated payment-shop code as unsafe for deployment.
Confidence: 96%Severity: 69%
Audit Metadata