generate-openenv-env
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill facilitates the research of target libraries and APIs from external sources to guide environment implementation. This process creates a surface where external content could potentially influence the generated code. While this is an inherent part of the skill's code-generation utility, it is a point where manual review of the produced code is recommended.
- [Remote Script Execution]: The included Dockerfile template downloads and executes an installation script for the
uvtool fromastral.sh. Whileastral.shis a well-known and official source for this development tool, the practice of executing remote scripts is a common security pattern to note in automated workflows. - [Command Execution during Validation]: The workflow involves executing several commands for building, validating, and testing the environment, including
openenv build,pytest, anduvicorn. These commands are standard for the development and testing of the resulting OpenEnv environments.
Audit Metadata