byted-bytehouse-slow-query

Warn

Audited by Socket on Sep 21, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/slow_query_analyzer.py

The visible code is intended as a ByteHouse slow-query analysis utility. It does not directly demonstrate malware, data exfiltration, destructive behavior, or a backdoor. However, it dynamically downloads and executes an unpinned GitHub main-branch dependency and passes that process all environment variables, potentially including database credentials and unrelated secrets. The fragment also contains apparent syntax and entry-point errors. The external repository should be pinned to a reviewed commit, verified, and given only the minimum required environment variables before use.

Confidence: 97%Severity: 78%
Audit Metadata
Analyzed At
Sep 21, 2026, 03:15 PM
Package URL
pkg:socket/skills-sh/bytedance%2Fagentkit-samples%2Fbyted-bytehouse-slow-query%2F@4b9dc335d56449418766609868fc4d0fb6526eb3425e412568eb278a9b83ff14