dfyx-code-security-review
Fail
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from
https://github.com/EastSword/skill-dfyx_code_security_review.git. This external repository is not associated with the skill's primary author ('Aradotso') or any recognized trusted organizations. - [REMOTE_CODE_EXECUTION]: Following the download, the instructions suggest executing Python scripts such as
scripts/code_scan.py,scripts/secret_finder.py, andscripts/data_flow_analyzer.py. Running code from an unverified third-party repository allows for arbitrary code execution within the agent's environment. - [COMMAND_EXECUTION]: The methodology and provided examples involve executing high-risk system commands through
subprocess.calland shell operations. While these are part of the intended audit functionality, the lack of verification for the source scripts makes this a high-risk capability.
Recommendations
- AI detected serious security threats
Audit Metadata