file-deduplicator

Warn

Audited by Socket on Oct 19, 2026

1 alert found:

Security
SecurityMEDIUM
index.js

This is a local duplicate-file utility with no observed network activity, credential access, or code execution. Its duplicate detection has significant implementation errors, and removeDuplicates can permanently delete files by default; the keepIndex mismatch may cause every file in a duplicate group to be deleted. Severity is high for data loss when removal is invoked, but the fragment does not establish malicious intent. The configurable log path can also escape the module directory if configured with traversal segments.

Confidence: 99%Severity: 83%
Audit Metadata
Analyzed At
Oct 19, 2026, 05:06 AM
Package URL
pkg:socket/skills-sh/modbender%2Fskill-library-mcp%2Ffile-deduplicator%2F@f17dc6a7b3e509f96ffc4148b22c753b9ad3a5bd2bc8add55910e8e062f2eca3