dbt-sf-to-bq-translator

Warn

Audited by Socket on Sep 10, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/dbt_translator.py

The code is a dbt/Snowflake-to-BigQuery migration utility. It intentionally uploads source and metadata files to caller-selected Google Cloud Storage locations and performs cloud cleanup operations. No clear malware, credential theft, backdoor, or obfuscated payload is present. The main security issue is unsafe ZIP extraction via extractall, which should be replaced with validated extraction that rejects absolute paths and traversal components. Cloud uploads should require explicit authorization and careful validation of bucket and prefix parameters.

Confidence: 96%Severity: 58%
Audit Metadata
Analyzed At
Sep 10, 2026, 09:02 AM
Package URL
pkg:socket/skills-sh/google%2Fskills%2Fdbt-sf-to-bq-translator%2F@8dc12d12289da533b21a1fe628c80f731ac48ad557ee32ec2209c72e9ba3b8d5
Security Audit — socket — dbt-sf-to-bq-translator