ego-jev

Warn

Audited by Socket on Sep 20, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/ego-jev

The fragment is a readable browser-automation launcher and contains no direct evidence of malware. Its main security concern is trust-boundary handling: EGO_JEV_LIB and EGO_BROWSER_BIN allow environment-controlled code execution, and EGO_JEV_LIB is embedded into a JavaScript heredoc without escaping, creating a potential code-injection issue when the environment is attacker-controlled. API keys are temporarily written to disk and browser task spaces may be taken over or modified by design. Review and constrain the engine path, executable PATH, and task-space permissions before use in untrusted environments.

Confidence: 96%Severity: 57%
Audit Metadata
Analyzed At
Sep 20, 2026, 10:45 AM
Package URL
pkg:socket/skills-sh/jiangkoumo%2Fego-jev%2Fego-jev%2F@b88f307e73e6c49f3ab140aa47e37410a7bc7715