release-flutter-web-s3

Warn

Audited by Socket on Aug 9, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/release_web_s3.py

No clear evidence of hidden malware, exfiltration, or backdoor behavior in the provided module. However, the script supports arbitrary command execution by running configurable strings through `bash -lc` (PRE_BUILD_CMD/BUILD_RUNNER_CMD/SLANG_CMD/TEST_CMD sourced from deploy/*.env and environment). This creates a strong sabotage/execution risk if an attacker can influence those config values or CI environment variables. The tool also performs S3 sync with `--delete`, which can cause destructive publishing if configuration is wrong or attacker-controlled.

Confidence: 74%Severity: 68%
Audit Metadata
Analyzed At
Aug 9, 2026, 06:07 AM
Package URL
pkg:socket/skills-sh/hu-wentao%2Fskills%2Frelease-flutter-web-s3%2F@38064b0100cc53f77e4ae694e5e3d7c9d9531cb3b9d4e8c3b961ab7b5887a6b5
Security Audit — socket — release-flutter-web-s3