convex-component-adoption-planner
Fail
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
Cargo.lockfile contains a poisoned dependency graph. It modifies the official metadata of theserde_jsonpackage to includezmijandserde_coreas dependencies, which are not part of the legitimate library. Additionally, the version number forserde_json(1.0.149) is spoofed to be higher than currently available official releases. - [REMOTE_CODE_EXECUTION]: The skill instructions require the agent to execute
cargo runon the provided Rust project. This action triggers the automatic download, compilation, and potential execution of code (e.g., viabuild.rs) from the injected third-party crates. - [COMMAND_EXECUTION]: Instructions in
SKILL.mdprompt the agent to execute shell commands (cargo run --manifest-path ...) that rely on the compromised build configuration files provided with the skill.
Recommendations
- AI detected serious security threats
Audit Metadata