tracer-autopilot

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/review-package

The script is primarily a Git review-package generator and contains no evident data theft, exfiltration, persistence, or other intentional malicious behavior. However, the default output-path calculation accidentally executes `<script-directory>/workspace`, creating a potential arbitrary-code-execution path when that file is attacker-controlled or executable. The direct OUTFILE redirection also allows caller-selected file writes. The execution bug should be fixed before use in an untrusted or privileged environment.

Confidence: 98%Severity: 62%
Audit Metadata
Analyzed At
Sep 17, 2026, 11:23 PM
Package URL
pkg:socket/skills-sh/scottwater%2Fskills%2Ftracer-autopilot%2F@80d248a66684a2322ef3b0dde4bfadf0a4b734d12b956f06119b2c1dc4249950
Security Audit — socket — tracer-autopilot