skills/agoodway/goodskills/can-opener/Gen Agent Trust Hub

can-opener

Warn

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands such as mix, cp, grep, and rm. Several of these commands use variables (e.g., <package_name>, <spec_path>) that are filled by user input. This pattern is susceptible to command injection if the inputs contain shell metacharacters (e.g., ;, &, |).\n- [REMOTE_CODE_EXECUTION]: The skill uses the mix run -e command to execute Elixir code dynamically, incorporating the user-provided <ModuleName>. It also performs a mix deps.get which fetches and executes code from the vendor's GitHub repository (github.com/agoodway/can_opener.git).\n- [EXTERNAL_DOWNLOADS]: The skill downloads Elixir dependencies from GitHub. It also provides an option to fetch an OpenAPI specification from a remote URL provided by the user, which involves downloading external content to the local system.
Audit Metadata
Risk Level
MEDIUM
Analyzed
May 13, 2026, 11:20 PM
Security Audit — agent-trust-hub — can-opener