feed-diet

Warn

Audited by Socket on Mar 27, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/hn-fetch.sh

Best report: Report 3 (most complete on flow, sinks, and anomalies). Improved assessment: This script appears to be a benign Hacker News data fetcher, but it has two notable security risks in this fragment: (1) credible code-injection risk because SINCE_EPOCH is interpolated unquoted into python3 -c source (`ts >= ${SINCE_EPOCH}`), and (2) unreviewed risk from sourcing `common.sh`, plus potential cache path manipulation if USERNAME is not sanitized in common.sh. No direct malware/exfiltration behavior is evident in the provided code fragment; however, local execution safety and dependency trust should be reviewed.

Confidence: 67%Severity: 58%
Audit Metadata
Analyzed At
Mar 27, 2026, 02:07 PM
Package URL
pkg:socket/skills-sh/cacheforge-ai%2Fcacheforge-skills%2Ffeed-diet%2F@c2f45eec4e9a06c61774088720a66b2693f3b003
Security Audit — socket — feed-diet