Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bridge.mjs:47
- Evidence
const child = spawn(host, ['--eagle-rpc'], { cwd: dirname(host), windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
Security audit
轻存 · Eagle 参考片
Security checks for vulnerabilities and agentic risk
Overview
This package is a clearly disclosed local bridge that lets an owner submit supported video URLs to a separately installed Qingcun/Eagle local engine.
Install only if you already intend to use the Qingcun local engine and Eagle integration. The package itself is small and scoped, but using it will hand selected video URLs to a separately installed local native component that may use your local browser/Eagle setup according to Qingcun's own behavior.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec