ohos-app-build-debug

Warn

Audited by Socket on Sep 16, 2026

1 alert found:

Security
SecurityMEDIUM
scripts/parse_crash.py

The code appears intended to invoke HarmonyOS/OpenHarmony hstack for crash-stack parsing and contains no evident credential theft, data exfiltration, persistence, destructive behavior, or cryptomining. However, the inline-content execution path is vulnerable to arbitrary command execution because os.system() receives a command string containing untrusted crash_content. The code also fails to parse as shown because 'epilog' is not assigned or supplied a value. Replace os.system() with subprocess.run() using an argument list and validate or safely transport inline content.

Confidence: 98%Severity: 78%
Audit Metadata
Analyzed At
Sep 16, 2026, 02:25 AM
Package URL
pkg:socket/skills-sh/openharmonyinsight%2Fopenharmony-skills%2Fohos-app-build-debug%2F@6784b3f6f391ca0ed29a0f9237baf9b0dc702286cf8cb2c4d56619692421f207