service-omni-queue-routing-config-deploy

Warn

Audited by Socket on Sep 6, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/tests/_bootstrap.py

This module is a high-impact subprocess orchestrator: it runs a repository bash deployment script with caller-controlled arguments and environment, including PATH manipulation. It also supports creating a temporary executable named `sf` from an unknown `_FAKE_SF`, which could cause the executed bash script to run spoofed tooling. No explicit malware/exfiltration is visible in this Python fragment alone, but the PATH + executable-dropping pattern warrants security review of the bash script and call sites, and verification of `_FAKE_SF` safety. Current confidence is limited by the incomplete snippet (missing `_FAKE_SF` value and truncated `__exit__`).

Confidence: 46%Severity: 66%
Audit Metadata
Analyzed At
Sep 6, 2026, 09:35 AM
Package URL
pkg:socket/skills-sh/forcedotcom%2Fsf-skills%2Fservice-omni-queue-routing-config-deploy%2F@62818741fa7ea9ffaf89fb5b215dcdc307b9bfb55e1bc09ccb8aa8c1ae27bc40
Security Audit — socket — service-omni-queue-routing-config-deploy