leetify
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads compressed CS2 demo files (.bz2 and .gz) from Leetify's replay servers (api-public.cs-prod.leetify.com) for local parsing. This is a primary function of the skill and targets the vendor's official infrastructure.
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runandsubprocess.check_outputto orchestrate its internal components (e.g., callingsteam_ids.pyfrom other scripts) and to invoke system utilities likebunzip2andgunzipfor decompressing downloaded game demos. - [REMOTE_CODE_EXECUTION]: The automated scan flagged a pattern where data is fetched from the Leetify API and processed. Analysis confirms this is legitimate fetching of JSON-formatted match metadata and binary demo files, which are then parsed by the standard
demoparser2library rather than being executed as code. - [DATA_EXFILTRATION]: The skill requires a
LEETIFY_API_KEYand transmits Steam IDs to the Leetify API. These operations are restricted to the official vendor domain (leetify.com) and are necessary for retrieving the requested player statistics.
Audit Metadata