Skills
skills/aradotso/devtools-skills/searchcli-volcengine-ai-search/Gen Agent Trust Hub

searchcli-volcengine-ai-search

Warn

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The documentation includes TypeScript examples (e.g., runSearch and runRecommendation functions) that use execSync to trigger CLI commands. These examples interpolate variables such as appId, query, and userId directly into a shell command string using template literals. This pattern allows for command injection if an attacker can manipulate the input parameters.
  • [REMOTE_CODE_EXECUTION]: The skill provides installation instructions that download and execute code from a remote GitHub repository (github.com/volcengine/SearchCLI.git) via git clone and npx skills add. This fetches external scripts and skill definitions into the execution environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 13, 2026, 10:04 AM
Security Audit — agent-trust-hub — searchcli-volcengine-ai-search