champion-tracker
Warn
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
champion_tracker.pyperforms dynamic code loading by usingimportlib.utilto execute a Python module from a path computed at runtime. It specifically attempts to loadlead-qualification/scripts/enrich_leads.pyfrom a relative parent directory. - [CREDENTIALS_UNSAFE]: The script includes a
_load_dotenvfunction that recursively traverses up to 10 levels of the parent directory structure to locate and parse.envfiles. This logic is designed to automatically harvest sensitive keys likeAPIFY_API_TOKENfrom the environment. - [EXTERNAL_DOWNLOADS]: The skill facilitates communication with the Apify API (
api.apify.com) to trigger a third-party LinkedIn profile scraper (supreme_coder~linkedin-profile-scraper). It transmits batches of LinkedIn URLs to this external service for enrichment. - [COMMAND_EXECUTION]: The
SKILL.mdfile provides specific shell commands for the agent to execute, including initialization and job change detection routines that run the localchampion_tracker.pyscript with various flags.
Audit Metadata