langgraph-development
Warn
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the unsafe
eval()function in thecalculatortool withinscripts/demo_runner.pyand inside the project templates defined inscripts/generate_template.py. This allows for arbitrary Python code execution if an AI agent processes malicious input and passes it to these tools. - [EXTERNAL_DOWNLOADS]: The
scripts/setup_environment.pyandscripts/quick_start.pyscripts perform automated installation of multiple Python packages from PyPI usingpip install. While the packages listed are standard libraries for AI development, the automated execution of installation commands from scripts is a significant capability. - [COMMAND_EXECUTION]: Central management scripts such as
start.py,run.py, andscripts/launch_studio.pyrely on thesubprocessmodule to launch external tools, shell commands, and other Python scripts to provide the interactive learning environment. - [COMMAND_EXECUTION]: The
scripts/test_agent.pyscript performs dynamic module loading using__import__andgetattrto load and execute agent graphs from paths provided at runtime.
Audit Metadata