design-brief-generator

Warn

Audited by Socket on Sep 15, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/generate_brief.sh

The script appears to have a legitimate document-generation purpose and does not contain evident malware. However, its use of eval with unsanitized interactive input creates a high-severity local command-injection vulnerability, and the unrestricted output filename permits arbitrary accessible file overwrites. Replace eval with direct variable assignment or safe indirection and validate the output path before writing.

Confidence: 99%Severity: 87%
Audit Metadata
Analyzed At
Sep 15, 2026, 07:35 PM
Package URL
pkg:socket/skills-sh/jamesrochabrun%2Fskills%2Fdesign-brief-generator%2F@d7c8731c029560429946d595463ee8049a93d2000a2af6769a405e042cd999ef