video-to-template

Warn

Audited by Socket on Oct 26, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/grab.mjs

This is a browser screenshot automation script, not inherently malware. If command-line arguments or specifications are untrusted, raw interpolation of s.scroll, s.layer, and s.up creates a browser-side code-injection risk, and unsanitized outDir/s.name permits filesystem path traversal or unintended overwrites. The supplied URL is visited, but this fragment shows no explicit data exfiltration; severity is dependent on input trust and runtime permissions.

Confidence: 96%Severity: 65%
Audit Metadata
Analyzed At
Oct 26, 2026, 10:21 AM
Package URL
pkg:socket/skills-sh/ar9av%2Fframesmith%2Fvideo-to-template%2F@8c53b68e77de2a0025186cea3432d0bc2076eaca73923576b7a73e1ce9dc233e