dbs-sync-to-dondon
Warn
Audited by Socket on Nov 10, 2026
1 alert found:
SecuritySecurityscripts/sync_material.py
MEDIUMSecurityMEDIUM
scripts/sync_material.py
This is a synchronization client that intentionally reads local AI conversation logs and referenced documents, then uploads selected content to https://101[.]201[.]141[.]217:8443 (or a configured server) using a stored bearer key and bundled CA. Redaction and secret checks reduce exposure but do not make the transfer risk-free, and path handling permits traversal-shaped paths from log content to select files outside the home directory and potentially write outside the staging directory. Optional persistence is installed only through an explicit scheduling command. No clear malware behavior is evident, but the privacy impact and path traversal risk warrant review.
Confidence: 98%Severity: 72%
Audit Metadata