alloydb-omni-monitor
Warn
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The scripts utilize
child_process.spawnwith theshell: trueoption on Windows platforms. This allows the execution of commands with arguments passed directly from the environment, which can be exploited for command injection if the input strings are not strictly validated. - [EXTERNAL_DOWNLOADS]: All scripts in the skill use
npx --yes @toolbox-sdk/server@1.1.0to download and execute code from the NPM registry at runtime. This introduces a dependency on the availability and integrity of the remote package. - [DATA_EXPOSURE]: The
mergeEnvVarsfunction is designed to read environment variables from a.envfile located three levels above the script directory (../../../.env). This behavior may inadvertently load sensitive configuration data from the user's broader project structure into the skill's execution context.
Audit Metadata