Skills
Navigate
skills/autohandai/community-skills/implementing-zero-trust-with-hashicorp-boundary/Gen Agent Trust Hub

implementing-zero-trust-with-hashicorp-boundary

Warn

Audited by Gen Agent Trust Hub on Jul 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The auditing agent in scripts/agent.py executes system commands via the boundary CLI using subprocess.run.
  • Evidence: The script uses __import__('os') to dynamically load the os module for environment variable access. This is an obfuscation pattern often used to bypass simple static analysis that monitors for system resource imports.
  • [CREDENTIALS_UNSAFE]: The SKILL.md file includes configuration snippets with hardcoded sensitive values.
  • Evidence: Multiple AEAD keys (root, worker-auth, and recovery) are hardcoded as static strings in the HCL examples.
  • Evidence: A PostgreSQL database connection string contains a hardcoded password: postgresql://boundary:password@localhost:5432/boundary.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to download and execute files from external sources.
  • Evidence: SKILL.md instructs users to download a GPG key from https://apt.releases.hashicorp.com/gpg and pipe it into sudo apt-key add - to install the vendor package.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 16, 2026, 09:09 AM
Security Audit — agent-trust-hub — implementing-zero-trust-with-hashicorp-boundary