bracketsbot-skill
Warn
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The central entry point in
scripts/cli.mjsutilizesspawnto execute various local Node.js utility scripts. This is part of the tool's internal architecture to delegate tasks like bracket generation, transaction preparation, and validation to dedicated sub-processes. - [DYNAMIC_EXECUTION]: The
walk-run-policycommand (implemented inscripts/walk-run-policy.mjs) uses the dynamicimport()function to load and execute JavaScript modules from a filesystem path provided via the--policy-moduleargument. While intended for extensibility, this mechanism allows the execution of arbitrary code from the specified file path. - [EXTERNAL_DOWNLOADS]: The skill performs network operations via
fetchto synchronize bracket state with the vendor's API athttps://brackets.bot/api/draft. This includes posting new predictions and fetching server-side updates to ensure local and remote states are aligned for human review and submission.
Audit Metadata