missions

Warn

Audited by Socket on Jul 24, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/missions.sh

No overt embedded malware/backdoor logic is visible in this Bash module. However, it is a high-risk supply-chain orchestrator because it (1) executes package.json-derived commands using eval (direct command-injection primitive), (2) automatically runs dependency installation which can execute arbitrary lifecycle scripts, and (3) invokes AI/tooling with explicit sandbox/permission bypass flags, increasing the blast radius if prompts, toolchain, or repository are malicious. Use only with strong provenance, sandboxing/containment, and removal of eval-based execution where possible.

Confidence: 70%Severity: 85%
Audit Metadata
Analyzed At
Jul 24, 2026, 03:10 AM
Package URL
pkg:socket/skills-sh/jonmumm%2Fskills%2Fmissions%2F@5a05dfc5a2d3f43db86ac71ea0ca114183c2f7870fcdb7270718b52592fdf902
Security Audit — socket — missions