data-autocleaning

Warn

Audited by Socket on Oct 3, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/dataplex_scanner.py

The code performs an understandable cloud data-profiling task, but its use of shell commands built from untrusted CLI arguments creates a command-injection risk. The table-derived output filename also permits path traversal if identifiers contain path separators. Use subprocess APIs with argument lists and validate or constrain identifiers and output paths.

Confidence: 98%Severity: 75%
Audit Metadata
Analyzed At
Oct 3, 2026, 01:08 PM
Package URL
pkg:socket/skills-sh/googlecloudplatform%2Fdata-agent-kit-plugin%2Fdata-autocleaning%2F@840ce4d903b31d946334a8f7a07fccf8a13dac5998d36f66ea0b25039b1467c2