skills/affaan-m/ecc/ito-compute/Gen Agent Trust Hub

ito-compute

Fail

Audited by Gen Agent Trust Hub on Jul 26, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone an external, unverified repository from https://github.com/Ito-Markets/ito-cloud-runtime.git and install its dependencies using npm ci.
  • [REMOTE_CODE_EXECUTION]: The skill proceeds to execute the downloaded and built code (ito.js and ito-mcp.js) using the node runtime. This pattern involves executing unverified code from a remote source.
  • [COMMAND_EXECUTION]: The installation and execution workflow relies on multiple shell commands, including git clone, npm ci, npm run check, and direct invocation of JavaScript files with node. These operations run external logic that can access the host system and environment variables.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 26, 2026, 07:42 AM
Security Audit — agent-trust-hub — ito-compute