Is @promptbook/google safe?

The component can run operating-system commands or spawn processes.

import { type ChildProcess } from 'child_process';

import type { ChildProcess } from 'child_process';

import { type ChildProcess } from 'child_process';

import type { ChildProcess } from 'child_process';

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component makes outbound network requests.

import http from 'http';

import http from 'http';

import http from 'http';

import type http from 'http';

import http from 'http';

import http from 'http';

import http from 'http';

import type http from 'http';

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.