version-bump-reviewer
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill executes external code by calling
uvxwith a source URL pointing to a third-party GitHub repository (github.com/wshobson/agents.git) to perform skill evaluation. - [COMMAND_EXECUTION]: The skill uses various shell commands including
git(diff, log, status, add, commit) for repository management andmakefor structural validation. It also usesmkdir,cp, anduvxfor runtime operations. - [EXTERNAL_DOWNLOADS]: Fetches the
plugin-evaltool from an external GitHub repository at runtime. This dependency is not hosted by the skill author or a recognized trusted organization. - [REMOTE_CODE_EXECUTION]: The evaluation source URL (
$SRC) is derived from an environment variablePLUGIN_EVAL_SOURCE, allowing the code execution path to be dynamically changed at runtime.
Audit Metadata