piracy-handler
Warn
Audited by Gen Agent Trust Hub on Feb 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (MEDIUM): The skill extensively uses
child_process.spawnSyncto execute external utilities and scripts. Inscripts/shared/lib.ts, thesqliteJSONfunction executes shell commands usingsqlite3. While current internal usage sanitizes inputs, the function itself is a powerful primitive for arbitrary SQL execution. Additionally, functions likerunTaskFetchandrunTaskCreateexecute scripts usingnpx tsxwithin a directory located at../../../feishu-bitable-task-manager, creating a dependency on code outside the skill's own scope. - [EXTERNAL_DOWNLOADS] (LOW): The skill performs network requests to external services.
scripts/data/result_source.tsusesfetchto query Supabase REST APIs, andscripts/whitelist_check.tscalls a custom crawler service API atCRAWLER_SERVICE_BASE_URL. - [CREDENTIALS_UNSAFE] (SAFE): No hardcoded credentials were found. Sensitive keys such as
FEISHU_APP_SECRETandSUPABASE_SERVICE_ROLE_KEYare correctly managed via environment variables.
Audit Metadata