tracer-autopilot
Warn
Audited by Socket on Sep 17, 2026
1 alert found:
AnomalyAnomalyscripts/review-package
LOWAnomalyLOW
scripts/review-package
The script is primarily a Git review-package generator and contains no evident data theft, exfiltration, persistence, or other intentional malicious behavior. However, the default output-path calculation accidentally executes `<script-directory>/workspace`, creating a potential arbitrary-code-execution path when that file is attacker-controlled or executable. The direct OUTFILE redirection also allows caller-selected file writes. The execution bug should be fixed before use in an untrusted or privileged environment.
Confidence: 98%Severity: 62%
Audit Metadata