Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/cli.js:41
- Evidence
const result = spawnSync(process.execPath, args, { stdio: "inherit" });
Security audit
@psyb0t/predictalot
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed bridge to a user-run forecasting server and does not show hidden or purpose-mismatched behavior.
Install only if you intend to connect your agent to a predictalot server you control or trust. Configure PREDICTALOT_URL carefully, and provide PREDICTALOT_AUTH_TOKENS only for the intended server because the bridge forwards it as an Authorization bearer token to the MCP proxy process.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec