cover

Warn

Audited by Socket on Sep 2, 2026

1 alert found:

Anomaly
AnomalyLOW
index.js

This module is a build/orchestration helper that ingests untrusted quote text/JSON, writes it to a temp JSON file, and then executes a local `generate.sh` via `bash` to render PNG artifacts. There is no visible direct malware logic (no network calls, no credential access, no eval/Function), but the execution of an external shell script with arguments derived from caller-controlled paths and untrusted content constitutes a significant supply-chain/execution risk. Security ultimately hinges on `generate.sh` and upstream validation of `outputDir` and the quote content.

Confidence: 55%Severity: 62%
Audit Metadata
Analyzed At
Sep 2, 2026, 03:13 AM
Package URL
pkg:socket/skills-sh/zinan92%2Fvideocut%2Fcover%2F@15ce5e899f46b5ead77e20dd4444cb71ed49b4df3f78c9e6d1539a2ae5caa7fe