0xcarnemuerta-security-hub-portfolio
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from
https://github.com/reedjordanvrb4237/0xcarnemuerta-security-hub.git. This repository belongs to an unknown user and is not associated with the trusted organizations or the skill author's verified infrastructure. - [COMMAND_EXECUTION]: The documentation provides commands to start local web servers using
python3 -m http.server,npx http-server, andphp -S. These commands expose the current working directory to the local network, which can lead to information disclosure if executed in a sensitive directory. - [REMOTE_CODE_EXECUTION]: The skill includes a code example for a 'Secure ML Pipeline' that utilizes
pickle.loads(decrypted_model). Thepicklemodule in Python is insecure against erroneous or maliciously constructed data and can result in arbitrary code execution during deserialization.
Audit Metadata