alloydb-omni-optimize
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The scripts use
npx --yesto download and execute the@toolbox-sdk/serverpackage from the public NPM registry at runtime. This package is pinned to version1.1.0and is an official component associated with the skill's functionality. - [REMOTE_CODE_EXECUTION]: By invoking the
@toolbox-sdk/serverpackage throughnpx, the skill performs remote code execution of the utility. This mechanism is the intended design for the toolbox-based implementation of the database management tools. - [COMMAND_EXECUTION]: The skill uses
child_process.spawnto execute shell commands. It implements platform-specific logic (e.g., usingnpx.cmdon Windows) and applies quoting/escaping to parameters passed from the agent to the underlying CLI tool. - [SAFE]: The skill follows security best practices for credential management by loading sensitive information, such as
ALLOYDB_OMNI_PASSWORD, from a local.envfile instead of hardcoding secrets or requiring them as plain-text inputs. It specifically includes logic to detect and parse these files from the project directory tree.
Audit Metadata