Security audit

@gecho-ai/gecho-bridge-bundle

Security checks across malware telemetry and agentic risk

Overview

This package is a disclosed Gecho Bridge integration that uses a local MCP service and Chrome extension to collect TikTok, Amazon, TikTok Shop, and X research data into local files.

Install only if you are comfortable letting the Gecho Chrome extension use your logged-in browser session to collect platform data you request. Review the requested save_dir or GECHO_DATA_DIR because raw scraped results are written locally, and keep control of login, CAPTCHA, and account-verification steps in the browser.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

64/64 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp-client.cjs:34061
Evidence: const child = spawn(process.execPath, [SERVICE_PATH], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/server.cjs:3989
Evidence: if (browserPath) return spawn(browserPath, [url], { detached: true, windowsHide: true, stdio: "ignore" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-clawhub-skills.js:351
Evidence: const result = spawnSync(commandParts[0], [...commandParts.slice(1), ...args], { stdio: "inherit" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-modelscope-skills.js:594
Evidence: const result = spawnSync(process.execPath, [path.join(projectRoot, "scripts", "validate-skills.js")], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-tencent-skillhub.js:681
Evidence: const result = spawnSync(command, args, { stdio: "inherit" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: server.js:287
Evidence: if (browserPath) return spawn(browserPath, [url], { detached: true, windowsHide: true, stdio: "ignore" });

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: dist/mcp-client.cjs:29142
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);