moviepilot-update
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/mp-update.pyutilizes__import__to load thesubprocessmodule and executes a script located at a relative path in a sibling directory (moviepilot-api). This is a legitimate interaction between related components from the same vendor. - [COMMAND_EXECUTION]: User-provided inputs are strictly validated against a hardcoded set of allowed command and mode names (e.g., 'versions', 'restart', 'upgrade', 'release', 'dev') before being passed to the execution environment, effectively preventing injection vulnerabilities.
Audit Metadata