service-registry
Warn
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithshlex.splitto execute commands defined inServiceConfig. Inmodules/execution-patterns.md, thebuild_commandfunction uses.format()to inject prompts and file paths directly into command strings, which can lead to command injection if the input is not strictly validated. - [COMMAND_EXECUTION]: The
ServiceConfigincludes fields forauth_check_cmdandhealth_check_cmd, which are designed to execute arbitrary shell commands to verify service status. - [EXTERNAL_DOWNLOADS]: The skill references an external library
leyline.service_registryand mentions dependencies likequota-managementandusage-logging. These appear to be internal or vendor-specific modules, but they represent a dependency on external logic.
Audit Metadata