harnass-engineer-start
Warn
Audited by Socket on Mar 8, 2026
1 alert found:
SecuritySecuritydocuments/shared/templates/target-repo/scripts/executor.py
MEDIUMSecurityMEDIUM
documents/shared/templates/target-repo/scripts/executor.py
This file is an executor/orchestrator that intentionally runs shell commands defined in repository YAML and updates repository state. I did not find obfuscation, embedded credentials, or explicit malware like backdoors or reverse shells. However, the code executes arbitrary shell commands (shell=True) and runs network calls and git operations based on repository-controlled YAML, which is a high-risk pattern for supply-chain or repo-compromise scenarios. Use only in trusted environments and ensure YAML inputs and repository authorship are tightly controlled.
Confidence: 85%Severity: 70%
Audit Metadata