Is hacksider/Deep-Live-Cam safe?
repo is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: filesystem read, filesystem write, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
repo
- Python shell/command execution
- Python filesystem write/delete
- Python filesystem read
No malicious indicators found by static analysis.
Findings (4)
The component can run operating-system commands or spawn processes.
reader = subprocess.Popen(
reader_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
)writer = subprocess.Popen(
writer_cmd, stdin=subprocess.PIPE, stderr=subprocess.PIPE,
)subprocess.check_output(commands, stderr=subprocess.STDOUT)
output = subprocess.check_output(command).decode().strip().split("/")output = subprocess.check_output(command).decode().strip()
output = subprocess.check_output(command).decode().strip()
Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
The component reads files from disk.
with open(file_path, "r", encoding="utf-8") as file:
with open("switch_states.json", "r") as f:Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
shutil.copy2(modules.globals.target_path, modules.globals.output_path)
shutil.rmtree(temp_directory_path + f"/{i}")with open("switch_states.json", "w") as f:with open(temp_path, "wb") as f:
os.remove(output_path)
shutil.move(temp_output_path, output_path)
shutil.rmtree(temp_directory_path)
with open(download_file_path, "wb") as f:
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
import requests
response = requests.get(
"https://thispersondoesnotexist.com/",
headers={"User-Agent": "Mozilla/5.0"},
timeout=10,
)import urllib
request = urllib.request.Request(url)
response = urllib.request.urlopen(request, context=ctx)
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentOr get notified if this component's risk changes:
How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →