cluster-ops

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute curl commands interacting with a Couchbase Server REST API. These operations are performed on localhost:8091, which is the default local administration port for the service the skill is designed to manage.
  • [REMOTE_CODE_EXECUTION]: An automated alert flagged a pattern where API output is piped to python3 for processing. Analysis confirms this is a benign one-liner used to parse JSON metadata locally (python3 -c "import sys,json; ..."). Since the source is localhost and the execution script is a static string within the skill rather than an external download, it does not constitute a remote code execution risk.
  • [CREDENTIALS_UNSAFE]: The skill follows security best practices by using the $CB_ADMIN_PASSWORD environment variable for authentication instead of hardcoding sensitive credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 09:28 AM
Security Audit — agent-trust-hub — cluster-ops