AGENTSCORE-2026-0128
MCP package: @bashbop/otito
Published 9/15/2026 · 1.9.2 → 1.10.0
@bashbop/otito updated from 1.9.2 to 1.10.0. Score changed 75/100 to 65/100 (-10). Risk: MODERATE to ELEVATED. 3 findings.
75 → 65
Score
MODERATE → ELEVATED
Risk
WARN
Verdict
Findings
- low install_script: Package has 'postinstall' script: node scripts/postinstall.mjs
- medium hardcoded_secret: Hardcoded secret found (AWS key, OpenAI key, GitHub token, or npm token) (downgraded — mitigators detected in scope: test_fixture:fixture)
- high command_injection: Potential command injection: shell execution with template literal input