connectors-available

The script is primarily a connector availability and data-export utility, not clear malware. The main supply-chain risk is execution of arbitrary commands from any selected .env file via source. It also uses weak default credentials, can send credentials to an environment-controlled API endpoint, permits arbitrary output paths, and constructs JSON without escaping. These issues warrant review and hardening, especially if the script or its working directory can be influenced by untrusted content.

The script appears intended to query and display trading rules and contains no evident malware, network exfiltration, credential theft, or destructive behavior. However, untrusted --token and --data values are interpolated into Python source through an unquoted heredoc, creating a credible Python code-injection vulnerability. Inputs should be passed through environment variables or arguments to a quoted heredoc, with proper validation. The --data option also allows arbitrary file reads by design.

The script is a connector health-check utility. It contains no clear malicious payload or unauthorized external destination. The principal security risk is arbitrary command execution from any compromised or attacker-controlled .env file, combined with insecure default credentials and possible Basic Authentication over HTTP. The code itself is readable and not intentionally obfuscated.