qa-report

Warn

Audited by Socket on May 11, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/generate_test_cases.sh

No clear indicators of intentional malware (no networking, credential access, persistence, or destructive behavior). However, the script contains a severe shell security flaw: it uses `eval` to assign variables from user-controlled input, which can allow arbitrary command execution under the script runner’s privileges. Additionally, the script writes/overwrites files in a user-specified directory, increasing the impact of misuse. Overall, this module should be treated as high risk despite being “only” an artifact generator.

Confidence: 78%Severity: 75%
Audit Metadata
Analyzed At
May 11, 2026, 11:10 AM
Package URL
pkg:socket/skills-sh/compozy%2Fskeeper%2Fqa-report%2F@5214f73c089d1b966cf2ec4747d5b200793cf4e5
Security Audit — socket — qa-report