go

Warn

Audited by Socket on Sep 11, 2026

1 alert found:

Security
SecurityMEDIUM
evals/files/fetcher.go

The code is a network-fetching utility, not apparent malware. It has significant reliability and security weaknesses: caller-controlled URLs are fetched without validation, requests have no timeout, response bodies are unbounded, and shared map and slice state are unsynchronized. The channel/collector lifecycle is incorrect and can produce incomplete results or goroutine leaks. These issues should be fixed before using the function with untrusted URLs or high-volume inputs.

Confidence: 99%Severity: 76%
Audit Metadata
Analyzed At
Sep 11, 2026, 03:15 PM
Package URL
pkg:socket/skills-sh/lynricsy%2Fhyperskills%2Fgo%2F@23d8e1e91652cf4905979dcf048e95ea15642b942d642abc17c539def7dfc967
Security Audit — socket — go