ohos-app-build-debug
Warn
Audited by Socket on Sep 16, 2026
1 alert found:
SecuritySecurityscripts/parse_crash.py
MEDIUMSecurityMEDIUM
scripts/parse_crash.py
The code appears intended to invoke HarmonyOS/OpenHarmony hstack for crash-stack parsing and contains no evident credential theft, data exfiltration, persistence, destructive behavior, or cryptomining. However, the inline-content execution path is vulnerable to arbitrary command execution because os.system() receives a command string containing untrusted crash_content. The code also fails to parse as shown because 'epilog' is not assigned or supplied a value. Replace os.system() with subprocess.run() using an argument list and validate or safely transport inline content.
Confidence: 98%Severity: 78%
Audit Metadata