boltz
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the official CLI tool using a shell script from the provider's domain (
https://install.boltz.bio/boltz-api/install.sh). This is standard installation behavior for the service. - [REMOTE_CODE_EXECUTION]: The installation process involves piping a remote shell script to
sh. This is documented in theSKILL.mdunder the Install section and targets the official service endpoint. - [COMMAND_EXECUTION]: The skill makes extensive use of the
boltz-apicommand-line interface to perform scientific workflows. It also includes apersist.shscript to mirror artifacts between ephemeral and persistent storage in hosted environments. - [CREDENTIALS_UNSAFE]: The skill requires a
BOLTZ_API_KEYto be set in the environment. It correctly advises users to use hosted environment injection or a local.envfile, following secret management best practices rather than hardcoding credentials.
Audit Metadata