audit: indranilbanerjee/digital-marketing-pro (91/100, security:BLOCKED, progressive, 202 artifacts)

auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md

@@ -0,0 +1,32 @@
+<!--
+Auto-prepared disclosure body for indranilbanerjee/digital-marketing-pro.
+The audit workflow's GITHUB_TOKEN cannot file issues on third-party
+repos, so this body sits here pending manual filing:
+
+  gh issue create --repo indranilbanerjee/digital-marketing-pro \
+    --title 'Security findings in executable artifacts' \
+    --body-file auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md
+
+After filing, record the URL with:
+  jq '.repos["indranilbanerjee/digital-marketing-pro"] += {disclosure_url: "<URL>", disclosure_filed_at: "<ISO8601>", disclosure_filed_by: "manual"}' \
+    auditor/registry/repos.json > /tmp/r.json && mv /tmp/r.json auditor/registry/repos.json
+-->
+
+## Security Findings in Executable Artifacts
+
+While auditing NL programming artifacts in this repository, our scanner detected potential security issues in executable files.
+
+### Findings
+
+| # | Severity | File | Line | Pattern | Description |
+|---|----------|------|------|---------|-------------|
+| 1 | High | scripts/output-publisher.py | 77 | file-write-outside-repo | `get_visible_publish_dir()` resolves to `~/Documents/DigitalMarketingPro/{brand}`; `_publish_file()` copies artifacts there via `shutil.copy2()` — a write outside the repo/plugin sandbox into the user's home directory (documented "publish" feature, not attacker-controlled, but matches the HIGH pattern literally) |
+| 2 | High | scripts/sync_model_registry.sh | 52 | file-write-outside-repo | Destination path is computed via `../` traversal to a sibling checkout outside the repo root, then written by the embedded Python `json.dump` at line 93; no curl-pipe-sh or unvalidated remote download present, but the write target itself escapes the repo tree |
+
+### About This Report
+
+These findings come from [NLPM](https://github.com/xiaolai/nlpm)'s security scanner, which checks executable surfaces (hooks, scripts, MCP configs, dependencies) against known-dangerous patterns.
+
+We may be wrong — false positives happen. If any finding is intentional or already mitigated, please close this issue. If a finding is genuine and you'd like a fix PR, let us know.
+
+Full audit report: https://github.com/xiaolai/nlpm/blob/main/auditor/audits/indranilbanerjee-digital-marketing-pro.md

auditor/logs/events.jsonl

@@ -3761,9 +3761,14 @@
 {"timestamp":"2026-08-05T02:07:56Z","workflow":"discover","event":"search_complete","run_id":"30968348211","run_number":39,"data":{"candidates":161,"new":57,"worthy":6,"oversized":18}}
 {"timestamp":"2026-08-05T04:36:41Z","workflow":"classify","event":"classifications_emitted","run_id":"30975581065","run_number":107,"data":{"classifications":0,"invalid":0,"no_dissent":true}}
 {"timestamp":"2026-08-05T05:14:52Z","workflow":"track","event":"status_check","run_id":"30977076136","run_number":653,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}}
+{"timestamp":"2026-08-05T07:18:54Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","sidecar":"auditor/audits/indranilbanerjee-digital-marketing-pro.findings.jsonl","drifts":8,"exit_code":1,"total_findings":127,"missing_confidence":0}}
+{"timestamp":"2026-08-05T07:18:58Z","workflow":"audit","event":"findings_aggregated","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","findings":127,"invalid_lines":0,"self_false_positives":0}}
+{"timestamp":"2026-08-05T07:18:58Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","html":"auditor/reports/indranilbanerjee-digital-marketing-pro.html"}}
+{"timestamp":"2026-08-05T07:18:59Z","workflow":"audit","event":"audit_complete","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","score":91,"artifacts":202,"strategy":"progressive"}}
 {"timestamp":"2026-08-05T07:03:41Z","workflow":"audit","event":"scorer_drift_check","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","sidecar":"auditor/audits/Shubhamsaboo-awesome-llm-apps.findings.jsonl","drifts":0,"exit_code":0,"total_findings":23,"missing_confidence":0}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"findings_aggregated","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","findings":23,"invalid_lines":0,"self_false_positives":0}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"repo_report_rendered","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","html":"auditor/reports/Shubhamsaboo-awesome-llm-apps.html"}}
 {"timestamp":"2026-08-05T07:03:42Z","workflow":"audit","event":"audit_complete","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","score":96,"artifacts":11,"strategy":"single"}}
 {"timestamp":"2026-08-05T07:03:59Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983032406","run_number":744,"data":{"repo":"Shubhamsaboo/awesome-llm-apps","queue_path":"auditor/disclosures-pending/Shubhamsaboo-awesome-llm-apps.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}}
+{"timestamp":"2026-08-05T07:20:46Z","workflow":"audit","event":"manual_disclosure_pending","run_id":"30983048070","run_number":747,"data":{"repo":"indranilbanerjee/digital-marketing-pro","queue_path":"auditor/disclosures-pending/indranilbanerjee-digital-marketing-pro.md","gh_error":"GraphQL: Resource not accessible by integration (createIssue)"}}
 {"timestamp":"2026-08-05T09:09:12Z","workflow":"track","event":"status_check","run_id":"30991292365","run_number":654,"data":{"contributed":57,"tracked":37,"case_study_ready":42,"rule_adopted":2}}

auditor/registry/repos.json

@@ -9746,10 +9746,13 @@
       "stars": 705,
       "artifacts": 203,
       "description": "Open-source AI marketing plugin for agencies & in-house teams — 158 skills, 25 specialist agents, 12-Part Strategy Flow, Cowork team-persistent, EU AI Act Article 50 ready, 6-platform AEO/GEO incl. Google AI Mode. Installs on Claude Code, Cowork, Codex, Cursor, Copilot CLI, Antigravity. MIT-licensed.",
-      "status": "discovered",
-      "score": null,
+      "status": "audited",
+      "score": 91,
       "audit_issue": 760,
-      "prs": []
+      "prs": [],
+      "strategy": "progressive",
+      "security": "BLOCKED",
+      "commit_sha_at_audit": "e39f3940519ddb4103c197ccf7ec4951d5e8a8b9"
     },
     "microsoft/skills": {
       "discovered": "2026-08-05T02:07:37Z",