juejin-auto-checkin

Warn

Audited by Socket on Apr 23, 2026

1 alert found:

Anomaly
AnomalyLOW
scripts/cron_manager.py

Best assessment: This module is primarily a macOS LaunchAgent scheduler/runner for a Python script. It does not show explicit malware behavior (no exfiltration/networking/credential theft in this fragment), but it provides persistence (LaunchAgents) and immediate execution. The main security weakness is the use of os.system with an unquoted, unvalidated script_path from CLI modes, which can enable shell interpretation/command injection and broad arbitrary script execution under the user context if parameters are attacker-influenced. Additionally, the snippet appears corrupted/truncated, lowering confidence in complete behavior.

Confidence: 60%Severity: 66%
Audit Metadata
Analyzed At
Apr 23, 2026, 12:33 AM
Package URL
pkg:socket/skills-sh/wcly%2Fskills%2Fjuejin-auto-checkin%2F@fe92caf6d6037bd5196cdde716ee340803e83cf4