service-omni-command-center-analyze

Warn

Audited by Socket on Sep 18, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/tests/_bootstrap.py

This code is a dynamic command orchestrator that executes a project-provided bash script while allowing substantial caller influence over the runtime environment (notably PATH) and optionally overrides a dependency tool by creating a fake executable named `sf`. No direct malicious behavior (exfiltration, backdoor, persistence) is shown in the fragment, but the combination of (1) executing an external shell script and (2) injecting/overriding an executable via PATH resolution creates meaningful supply-chain/security risk. The assessment is limited by the incomplete `_FAKE_SF` definition and missing integration context for how `FakeSf` affects `PATH` during `run()` execution.

Confidence: 42%Severity: 62%
Audit Metadata
Analyzed At
Sep 18, 2026, 07:25 PM
Package URL
pkg:socket/skills-sh/forcedotcom%2Fsf-skills%2Fservice-omni-command-center-analyze%2F@b4b0148bccd77fe4f9b2b7fe03fd6eb20018cd115bc1c432ef9991a127bfaa88
Security Audit — socket — service-omni-command-center-analyze