byted-bytehouse-cluster-diagnostics

Warn

Audited by Socket on Jul 30, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/export_config.sh

This module is security-sensitive because it turns external JSON file content into shell code and executes it using eval. Even with jq @sh applied to values, the JSON keys are not validated as safe shell identifiers, leaving a potential command-injection vector if an attacker can modify ~/.bytehouse_config.json (or otherwise influence its contents). No explicit malware (exfiltration/persistence/backdoors) is visible in the provided fragment, but the eval-based design is a significant risk that warrants review and likely replacement with a safer non-eval approach (e.g., strict key validation and direct environment assignment).

Confidence: 52%Severity: 74%
Audit Metadata
Analyzed At
Jul 30, 2026, 04:44 PM
Package URL
pkg:socket/skills-sh/bytedance%2Fagentkit-samples%2Fbyted-bytehouse-cluster-diagnostics%2F@8c5bd0c2302bb6c75c1f4f2652f9976329d04c7d4965637d817c31e72b1a0b37
Security Audit — socket — byted-bytehouse-cluster-diagnostics