axiom-sre

The fragment does not show clear malicious behavior or data exfiltration. It performs expected local memory cleanup and optional Git publication, but it has meaningful integrity and operational risks: unvalidated --org path construction permits path traversal to eligible directories, cleanup can delete or rewrite data based on file-controlled metadata, and the default mode automatically commits and pushes changes. Review and harden path validation, require explicit sharing, and add backups or confirmation before destructive cleanup.

This is an administrative Sentry API helper with no evident malicious payload. It has a significant command-injection risk through eval of config-helper output and a potential authenticated SSRF or credential-disclosure risk because arbitrary absolute HTTP(S) URLs are accepted. Restrict deployments and destinations, avoid eval by using explicit variable assignments or a safely sourced configuration format, and ensure curl-auth only sends credentials to approved Sentry hosts.

The code is an expected Slack API utility and shows no clear malware or intentional data theft. The primary security concern is the unsafe eval of configuration-helper output, which could enable arbitrary command execution if that output is compromised or influenced. Unencoded query parameters and pagination cursors are additional correctness and request-manipulation risks. Configuration output should be parsed safely rather than evaluated, and URL parameters should be encoded.

The script appears to be a legitimate authenticated Axiom MetricsDB query helper. No clear malware, credential theft, persistence, or unrelated network exfiltration is present. The main security risk is executing configuration output through eval; a compromised config helper or attacker-controlled deployment value could result in arbitrary command execution. Prefer sourcing a validated shell config or using a structured configuration format instead of eval.

The script appears to be a legitimate Axiom query client. The main security risk is the use of eval on output from the configuration helper, which can execute arbitrary shell commands if the helper or its generated configuration is tampered with. The network request and token usage are consistent with the stated purpose, and no clear malicious behavior is present in this fragment.

The fragment is a legitimate URL-generation utility with no direct evidence of malware, credential theft, exfiltration, or obfuscation. Its primary security issue is the use of eval on local configuration output. This can become arbitrary command execution if the config helper, its generated output, or an attacker-controlled deployment-specific configuration is compromised. Replacing eval with a safer configuration parser or tightly validating the helper's output is recommended.

The code implements a legitimate Pyroscope label-query utility and contains no clear evidence of intentional malware, credential theft, persistence, or data exfiltration. The primary security concern is the eval of external configuration output, which can become arbitrary command execution if the config helper or its generated output is influenced by an attacker. Input validation is also insufficient for range_duration, and label_name should be JSON-encoded rather than interpolated. These issues warrant remediation, but the fragment alone does not establish malicious intent.

The code is a readable URL-generation utility with no evident malicious behavior, exfiltration, or destructive activity. The use of eval on output from the config helper is a significant command-injection risk if that helper or its configuration can be modified or emits attacker-controlled text. Replacing eval with a structured configuration interface or tightly validating its output would reduce the risk.

The code appears to be a legitimate Grafana alert-listing script. The primary security concern is the unsafe eval of config helper output combined with unvalidated deployment input. This creates a potentially serious command-injection path if the helper is compromised or constructs output from deployment data. The risk cannot be fully determined without reviewing config and curl-auth, but malicious behavior is not evident in this file.

The script is intended to generate Grafana Explore links and contains no apparent malware, exfiltration, or destructive behavior. However, eval executes all output from the local config helper, creating a high-impact command-injection risk if that helper or its output is attacker-controlled or tampered with. Replacing eval with a safer configuration interface or tightly validating the helper output is recommended.

The code implements an expected Git-based sharing workflow and contains no clear embedded malware or data-exfiltration logic beyond the intentional git push. It has a moderate security concern because the organization name is unsanitized for path traversal and because it stages and pushes all changes in the selected repository. Restrict ORG_NAME to a safe basename, resolve and verify the canonical path remains under ORGS_DIR, and consider limiting staged paths.

The code is an ordinary Pyroscope API query wrapper, with no direct evidence of malware or intentional data theft. The use of eval on configuration output is a significant command-execution risk if the local config helper, deployment value handling, or its output can be influenced by an attacker. Endpoint allowlisting and replacing eval with a safer configuration interface are recommended. The unreviewed curl-auth helper is an additional dependency boundary.

This appears to be a legitimate Pyroscope service-listing script, with no direct evidence of malicious behavior. However, executing configuration-helper output via eval creates a potentially serious command-injection path if the helper or deployment-derived configuration is attacker-controlled. Duration input should also be strictly validated before arithmetic evaluation. Review the config and curl-auth helpers and their configuration sources before treating the utility as safe.

The script appears to be a legitimate Grafana dashboard search utility. The use of eval on output from a configuration helper is a material command-injection risk if that helper is untrusted, writable by lower-privileged users, or constructs shell code from insufficiently validated deployment input. The supplied code does not provide evidence of intentional malware, but the omitted config and curl-auth helpers should be reviewed before treating the tool as safe.

The script appears to be a legitimate organization setup utility and contains no evident malware. It has a moderate security issue because an untrusted organization name can include path traversal components and redirect filesystem writes or git clone destinations outside ORGS_DIR. Validate ORG_NAME as a safe directory name, such as an allowlisted character set, before constructing ORG_DIR.

The fragment appears to be a legitimate Grafana API convenience wrapper, not malware. The use of eval with generated configuration output is a material command-injection risk if the config helper or its inputs can be modified or influenced. Endpoint validation is also absent, though its impact depends on the trusted GRAFANA_URL and curl-auth implementation. Review and replace eval with a safer configuration mechanism, and inspect config and curl-auth before deployment.

The script is intended to generate a Sentry URL using deployment-specific configuration. No direct data exfiltration, persistence, credential harvesting, or destructive behavior is present. However, eval executes arbitrary shell syntax returned by the local config helper, creating a potentially serious code-execution vulnerability if that helper or its configuration can be influenced or compromised. The code should avoid eval and parse a narrowly defined configuration value instead.

The code is a conventional authenticated API wrapper, but evaluating untrusted or insufficiently validated config output with eval creates a significant command-execution risk. The shown fragment provides no clear evidence of intentional malware; further review of config and curl-auth is required to determine whether their outputs and request handling are trusted.

This is a shell utility intended to list Grafana datasources for a selected deployment. It does not show clear malicious behavior, data theft, persistence, or destructive actions. The primary security concern is unsafe `eval` of output from the `config` helper, which can enable arbitrary command execution if that output is influenced by an attacker or a compromised dependency. The script should avoid `eval` and use a safer configuration interface.

The script appears to be a legitimate Pyroscope CLI utility, but its use of eval with output from a helper influenced by the deployment argument creates a potentially serious command-injection risk if the helper, configuration, or deployment data is attacker-controlled. No direct evidence of malware or intentional malicious behavior is present in the provided fragment. Assessment of curl-auth and config is required to determine exploitability.