bayma-toolbelt
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses dynamic loading of local code, which can be an entry point for malicious code if the local path is compromised.
- In the Bun quickstart,
await import()is used with a template literal to loadtoolbelt.tsfrom a path constructed using environment variables ($XDG_DATA_HOMEor~/.local/share). - In the Python quickstart, the skill explicitly modifies
sys.pathto include the toolbelt's local directory (~/.local/share/bayma/toolbelt) before importing thebayma_toolbeltmodule. - [COMMAND_EXECUTION]: The instructions guide the agent to perform shell command execution and process spawning.
- It recommends running
npx @bayma-repl/bayma doctorto install or repair the toolbelt environment. - The documentation suggests executing the
gitbinary and other tools (likebasedpyrightandruff) via subprocesses using specific wrapper scripts likebayma_toolbelt_process.pyor Rust'sstd::process::Command. - [EXTERNAL_DOWNLOADS]: The skill relies on fetching external code and dependencies at runtime.
- The installation process uses
npxto fetch the@bayma-repl/baymapackage from the NPM registry. - The Rust configuration uses
:depdirectives to download specific versions of numerous crates from the crates.io registry.
Audit Metadata