byted-bytehouse-data-quality-inspector

Warn

Audited by Socket on Jul 30, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/export_config.sh

This module is security-sensitive because it turns external JSON file content into shell code and executes it using eval. Even with jq @sh applied to values, the JSON keys are not validated as safe shell identifiers, leaving a potential command-injection vector if an attacker can modify ~/.bytehouse_config.json (or otherwise influence its contents). No explicit malware (exfiltration/persistence/backdoors) is visible in the provided fragment, but the eval-based design is a significant risk that warrants review and likely replacement with a safer non-eval approach (e.g., strict key validation and direct environment assignment).

Confidence: 52%Severity: 74%
Audit Metadata
Analyzed At
Jul 30, 2026, 04:45 PM
Package URL
pkg:socket/skills-sh/bytedance%2Fagentkit-samples%2Fbyted-bytehouse-data-quality-inspector%2F@b748910dc6165eebaf89956fc3b0255bde470c504713750cea3fc7c4e77b8886
Security Audit — socket — byted-bytehouse-data-quality-inspector