c-sharp-scripting

Warn

Audited by Socket on Oct 9, 2026

4 alerts found:

Anomalyx4
AnomalyLOW
examples/tables/format-power-query.csx

The code appears intended to format Power Query M code, not to install malware or establish unauthorized access. However, it transmits potentially sensitive model code to a hardcoded third-party Azure API and trusts the returned content before writing it back. Review the service ownership, privacy terms, data classification, and response validation before use. The provided fragment also contains malformed string literals in the replacement dictionary and would not compile as shown.

Confidence: 98%Severity: 58%
AnomalyLOW
examples/functions/delete-function.csx

The code is an intended administrative deletion script, not evidence of malware or unauthorized data theft. The primary security risk is destructive behavior combined with fail-open error handling: if Error() does not throw or terminate execution, the all-functions confirmation can be bypassed and missing-function handling can continue incorrectly. Pattern matching also lacks regex escaping, allowing unintended selection or malformed expressions. The deletion logic should explicitly return or throw after safety failures and should escape wildcard patterns before constructing the regex.

Confidence: 97%Severity: 62%
AnomalyLOW
examples/roles/delete-role.csx

The fragment is an explicit administrative role-deletion script, not apparent malware. Its main security concern is high-impact destructive behavior combined with incomplete safeguards and unsafe construction of a regular expression from rolePattern. The code should escape regex metacharacters or use a proper glob matcher, ensure Error() aborts execution, and ideally require authorization plus a dry-run or confirmation mechanism before deletion.

Confidence: 98%Severity: 62%
AnomalyLOW
examples/cultures/delete-culture.csx

The code is a plainly written administrative deletion script, not evidence of malware or supply-chain sabotage. Its current configuration deletes the es-ES culture and all associated translations. The main risk is destructive behavior combined with reliance on Error(...) to halt execution; if Error only logs an error, the all-mode confirmation check and missing-culture check can fail open. Pattern construction is also insufficiently escaped for externally supplied patterns, though no external pattern is shown here.

Confidence: 98%Severity: 55%
Audit Metadata
Analyzed At
Oct 9, 2026, 05:36 AM
Package URL
pkg:socket/skills-sh/data-goblin%2Fpower-bi-agentic-development%2Fc-sharp-scripting%2F@40a8435871a4df6edda63ff92b95d8e8d768e439498874559a8dbe1219fe6af8