self-test
Fail
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
run.pyscript performs unsafe shell command execution.\n - Evidence: The
executefunction inrun.pytakes parameterspackage,timeout, andcwddirectly from the inputargsdictionary without validation or sanitization.\n - Evidence: These parameters are interpolated into a command string:
cmd = f"CGO_ENABLED=0 go test {package} -v -json -timeout {timeout}".\n - Evidence: The resulting string is passed to
subprocess.run(cmd, shell=True, ...), which allows for shell metacharacter injection.\n - Risk: An attacker can manipulate these parameters to execute arbitrary shell commands with the same privileges as the agent process.
Recommendations
- AI detected serious security threats
Audit Metadata