mistral-codestral
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
ollama-herdPython package from a public registry. This is a vendor-owned package intended for managing the local fleet router described in the documentation. - [COMMAND_EXECUTION]: The skill uses
curlto interact with a local API service onlocalhost:11435to manage models and monitor fleet status. - Automated scans flagged commands like
curl ... | python3as potential remote code execution. However, detailed analysis shows these commands usepython3 -m json.tool, which is a standard utility for pretty-printing JSON data and does not involve executing arbitrary code from the network.
Audit Metadata