Security audit

@gecho-ai/gecho-bridge-bundle

Security checks across malware telemetry and agentic risk

Overview

The skill appears to support TikTok research as described, but it also installs a broad local browser bridge with extra exposed tools, automatic saved data, unauthenticated localhost controls, and vulnerable WebSocket dependencies that need review.

Review this before installing if you use a personal TikTok account or a shared machine. Prefer a dedicated research browser profile/account, choose an explicit save directory, periodically delete saved result files, and upgrade the WebSocket dependency before relying on the bridge. Also be aware that the installed MCP server exposes more than the TikTok search tools described by the Skill.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/mcp-client.cjs:34043
Evidence: const child = spawn(process.execPath, [SERVICE_PATH], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/server.cjs:3971
Evidence: if (browserPath) return spawn(browserPath, [url], { detached: true, windowsHide: true, stdio: "ignore" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: server.js:287
Evidence: if (browserPath) return spawn(browserPath, [url], { detached: true, windowsHide: true, stdio: "ignore" });

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: dist/mcp-client.cjs:29142
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);