t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
MEDIUMPython subprocess execution detectedscripts/assemble.py:44 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/generate_images.py:319 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/upload_project.py:451 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/upload_project.py:536 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/generate_video.py:841 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/qa.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/generate_video.py:581 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/assemble.py:35 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMURL using raw IP addressscripts/generate_video.py:87 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 MEDIUMPython subprocess execution detectedscripts/cut_audio.py:39 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 HIGHOutbound HTTP to raw IP addressscripts/generate_video.py:87 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 MEDIUMPython subprocess execution detectedscripts/generate_video.py:314 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMURL using raw IP addressscripts/_common.py:30 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 MEDIUMURL using raw IP addressscripts/config.example.json:13 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 MEDIUMPython subprocess execution detectedscripts/cut_audio.py:49 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/cut_audio.py:67 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 HIGHOutbound HTTP to raw IP addressscripts/config.example.json:13 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 MEDIUMPython subprocess execution detectedscripts/generate_video.py:639 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/assemble.py:61 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/qa.py:71 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 MEDIUMPython subprocess execution detectedscripts/generate_video.py:594 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05 HIGHOutbound HTTP to raw IP addressscripts/_common.py:30 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07 Instructions loaded
≈5,460 tok
1 file · 35 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.