site-content-catalog

This is intended as a website content-cataloging CLI, not evident malware. Its main security concern is SSRF: remote sitemap locations and redirects can cause requests to destinations beyond the requested site, including potentially internal addresses. Configured API tokens are sent in query parameters to the API endpoint, which may be redirected to a custom GOOSEWORKS_API_BASE; output files are written to user-specified paths. The fragment also has a syntax error and will not run as written; severity is moderate if the syntax is corrected and untrusted domains are processed.