AGENTSCORE-2026-0128
MCP package: @bashbop/otito
Published 9/15/2026 · 1.9.2 → 1.10.0
Withdrawn after review on 2026-09-25
The high-severity findings that triggered this advisory were checked in the package source and are not vulnerabilities. The reasons are listed under each finding below. The advisory stays at this address so the record is not silently rewritten. Reviewed in source: the flagged code was located in the published package, read in context and traced from input to sink (AI-assisted), and every confirmation was re-audited independently.
@bashbop/otito updated from 1.9.2 to 1.10.0. Score changed 75/100 to 65/100 (-10). Risk: MODERATE to ELEVATED. 3 findings.
75 → 65
Score
MODERATE → ELEVATED
Risk
WARN
Verdict
Findings
- low install_script: Package has 'postinstall' script: node scripts/postinstall.mjs
- medium hardcoded_secret: Hardcoded secret found (AWS key, OpenAI key, GitHub token, or npm token) (downgraded — mitigators detected in scope: test_fixture:fixture)
- high command_injection: Potential command injection: shell execution with template literal inputNot a vulnerabilityThe value is wrapped in a correct POSIX single-quote escaper, and every caller passes a constant tool name.