critical
suspicious.dangerous_exec
- Location
- bin/skillhub-launcher.mjs:182
- Finding
- Shell command execution detected (child_process).
- Evidence
const child = spawn(binaryPath, process.argv.slice(2), {
SkillHub MCP
AdvisoryAudited by Static analysis on May 20, 2026.
Overview
Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source
Findings (2)
warn
suspicious.install_untrusted_source
- Location
- .codex-plugin/plugin.json:13
- Finding
- Install source points to URL shortener or raw IP.
- Evidence
"SKILLHUB_DISCOVERY_HOST": "http://218.11.5.155:8399"