Stale Socket audit for ahaomar/un-editorial-check: projectIgnorePaths already present at audit time did not suppress the fixture alert

Summary

The Socket audit shown for ahaomar/un-editorial-check is stale and points at code that has since been fixed. The two ignore mechanisms this project can supply were already present at audit time and did not suppress the alert, so there does not appear to be any owner-side action that clears it.

Current state

GET https://skills.sh/api/v1/skills/audit/ahaomar/un-editorial-check/un-editorial-check:

Provider	Status	auditedAt
Gen Agent Trust Hub	pass	2026-09-30T12:10:30.727Z
Socket	warn — 1 alert: gptSecurity	2026-09-30T12:10:48.409Z
Snyk	pass — Risk: LOW	2026-09-30T12:09:45.841441+00:00

Two of three providers pass; Socket alone is pinned to 30 September.

What the alert is against

tests/fixtures/audits/security.mjs. That file is:

• a test fixture — its whole purpose is to contain two lookalike sinks so the suite can prove the security audit profile finds them;
• never executed by anything in the package;
• not shipped — package.json files omits tests, so the npm tarball does not contain it.

What has already been tried

Mechanism	Present at audit time?	Result
socket.yml → projectIgnorePaths: ["tests/fixtures/audits/security.mjs"]	Yes — added in 819fc6e (29 Sep), before the 30 Sep audit	Alert persisted
.socketignore	No — added later (1 Oct)	Not tested; per the docs this format is not read by this pipeline

socket.yml was therefore already in effect when Socket produced this warn, which suggests projectIgnorePaths did not suppress the alert for this package.

What actually fixed it

1b9417e — the fixture was restructured so its two sinks are quoted data, not live statements. The security profile still reports UE-SE001 + UE-SE004 for it, and both the fixture shape and that pair of ids are locked in tests/run.mjs in both directions (mutation-tested). The fixture contains no executable sink at all now.

That fix shipped as v1.5.1, commit 8d6395f.

Ask

1. Re-run the Socket audit for ahaomar/un-editorial-check against 8d6395f.
2. If that is not possible, let us know whether projectIgnorePaths is honoured for this purl — the table above is the evidence that it currently appears not to be.

Happy to supply anything needed: repo, commit range, the fixture diff, or raw audit responses.

Related: #1863 and its duplicates describe the same class of problem — no owner-triggered refresh path for a stale audit.