magnet-path

Warn

Audited by Socket on Sep 4, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/magnet_path.py

This module is best characterized as an authenticated data-visualization client that reads a plaintext bearer token from a local .env_agent_api file and sends it to a hardcoded remote API to fetch JSON chart data, then saves a Matplotlib-generated PNG to a user-supplied path. No clear execution/backdoor behavior is present in the fragment, but the supply-chain risk is elevated due to implicit local secret discovery and transmission of that secret to a fixed external destination, plus unvalidated file output path handling (possible overwrite).

Confidence: 72%Severity: 60%
Audit Metadata
Analyzed At
Sep 4, 2026, 09:56 PM
Package URL
pkg:socket/skills-sh/mphinance%2Falpha-skills%2Fmagnet-path%2F@4ed63759e73f67bb4a7659f4e7f9b61e47120d731d64110bf4f985499cf737aa
Security Audit — socket — magnet-path