read-gzh

Warn

Audited by Socket on Sep 14, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/fetch_wechat_article.py

The code is an intended WeChat article scraper and image downloader, not an apparent malware payload. It has a meaningful security concern because arbitrary command-line URLs are sent to curl with redirect following and without destination or scheme allowlisting, potentially enabling SSRF or unintended network access. Image downloads are more constrained by hostname matching but still follow curl behavior. The provided fragment also contains syntax errors and will not run as written. No secrets, obfuscated code, shell injection, persistence, or data theft behavior is present.

Confidence: 98%Severity: 52%
Audit Metadata
Analyzed At
Sep 14, 2026, 03:36 PM
Package URL
pkg:socket/skills-sh/aster110%2Fmycc%2Fread-gzh%2F@d7bcfff0572828f0918a439e4fad1fd855a9af04731e5cf0f662a82086387ce1