cleanup

Warn

Audited by Socket on Nov 11, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/cleanup.mjs

This utility performs Git cleanup and optional recursive directory deletion, with deletion disabled unless --apply is supplied. It contains security risks: shell injection may be possible through Git-derived paths or branch names, and traversal in session/run values may redirect temporary-directory deletion; the project path check is also not symlink-aware. These are potentially destructive behaviors, but the code shows no clear evidence of intentional malware or data theft.

Confidence: 94%Severity: 62%
Audit Metadata
Analyzed At
Nov 11, 2026, 06:52 AM
Package URL
pkg:socket/skills-sh/panqiwei%2Fpqw-skills%2Fcleanup%2F@27443f7a7b1c047ca3bb3c2a198c3ab555c6a54e50ed0962288efc494d3e51dc