mj-login
Warn
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill captures 'AuthUserToken' cookies from the Midjourney session and saves the storage state to a local directory. These files contain live authentication credentials that remain valid for at least 24 hours.
- [COMMAND_EXECUTION]: The skill executes external processes using 'pnpm', 'node', and 'tsx' to run automation scripts. It also suggests the execution of an external command 'art-repo-package-install' to install missing dependencies.
- [CREDENTIALS_UNSAFE]: The 'account_name' parameter, provided via CLI arguments, is used to construct file paths without any validation or sanitization. This creates a path traversal vulnerability, potentially allowing unauthorized access or modification of files outside the intended 'sessions' directory.
Audit Metadata