repomix-unmixer

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/unmix_repomix.py

The code is a file extraction utility with no clear malicious behavior, but it has a significant path traversal and arbitrary file overwrite risk because embedded paths are trusted. Treat repomix input as untrusted and validate that resolved output paths remain within the chosen output directory. The incomplete final main( also indicates a syntax error if present literally.

Confidence: 98%Severity: 70%
Audit Metadata
Analyzed At
Sep 15, 2026, 03:07 AM
Package URL
pkg:socket/skills-sh/daymade%2Fclaude-code-skills%2Frepomix-unmixer%2F@544bf9c859b144145c3ae227967d69ad3049eb4eedb6c2e4f29e4e65f7662c53
Security Audit — socket — repomix-unmixer