guardian-cli-ai-pentest
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an unverified third-party GitHub account (
https://github.com/zakirkun/guardian-cli.git) that is not listed as a trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: The installation guide includes the command
pip install -e .to be run within the cloned repository. This executes the package's installation logic (such assetup.py), which can run arbitrary code on the user's system during the setup process. - [COMMAND_EXECUTION]: The skill is designed to automate the execution of 19+ security assessment tools (including
nmap,sqlmap,nuclei,httpx, andxsstrike) via shell commands. While this is the intended purpose of a pentesting tool, it represents a high-privilege command execution surface that requires strict target scope management.
Audit Metadata