skills/eaucoin/bayma/bayma-toolbelt/Gen Agent Trust Hub

bayma-toolbelt

Warn

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses dynamic loading of local code, which can be an entry point for malicious code if the local path is compromised.
  • In the Bun quickstart, await import() is used with a template literal to load toolbelt.ts from a path constructed using environment variables ($XDG_DATA_HOME or ~/.local/share).
  • In the Python quickstart, the skill explicitly modifies sys.path to include the toolbelt's local directory (~/.local/share/bayma/toolbelt) before importing the bayma_toolbelt module.
  • [COMMAND_EXECUTION]: The instructions guide the agent to perform shell command execution and process spawning.
  • It recommends running npx @bayma-repl/bayma doctor to install or repair the toolbelt environment.
  • The documentation suggests executing the git binary and other tools (like basedpyright and ruff) via subprocesses using specific wrapper scripts like bayma_toolbelt_process.py or Rust's std::process::Command.
  • [EXTERNAL_DOWNLOADS]: The skill relies on fetching external code and dependencies at runtime.
  • The installation process uses npx to fetch the @bayma-repl/bayma package from the NPM registry.
  • The Rust configuration uses :dep directives to download specific versions of numerous crates from the crates.io registry.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 23, 2026, 04:23 AM