programming

Fail

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Multiple instruction files and scaffolding scripts (e.g., scripts/python/new-script.py) provide commands to install the uv tool from the official Astral domain (astral.sh) using a shell-piped curl | sh pattern. This is documented for a well-known developer service and is considered safe per the well-known service rule.
  • [COMMAND_EXECUTION]:
  • Scaffolding scripts in the scripts/ directory for Python, Rust, and Go utilize Python's subprocess.run to execute local initialization commands such as go mod init, cargo init, and uv init. These are functional requirements for generating project layouts.
  • The TypeScript auditor (scripts/typescript/check-no-excuse-rules.ts) dynamically resolves and loads TypeScript modules from the audited project's local directory using createRequire and process.cwd(). This allows the tool to accurately audit the specific code context using the project's own compiler version.
Recommendations
  • HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 2, 2026, 04:50 PM
Security Audit — agent-trust-hub — programming