get-biji

Warn

Audited by Socket on Oct 20, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/dedupe.js

This utility deduplicates Markdown summaries and deletes duplicate summaries and their associated transcript paths. Because transcript paths come from unvalidated frontmatter, a crafted value containing ../ can cause deletion outside the notes directory when its summary is in a duplicate group. This is a moderate destructive file-operation risk; no evidence of data exfiltration or other malware behavior is present.

Confidence: 98%Severity: 55%
Audit Metadata
Analyzed At
Oct 20, 2026, 09:58 AM
Package URL
pkg:socket/skills-sh/suyuan2022%2Fsuyuan-skill%2Fget-biji%2F@c2ed9c62d6d21243d1713e0740d20b32a2e2a19d7ce68c2b23b27c8a0a9870d6