hummingbot-deploy
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads code and scripts from official 'hummingbot' repositories. It clones
https://github.com/hummingbot/hummingbot-api.gitand fetches setup/verification scripts fromhttps://raw.githubusercontent.com/hummingbot/skills/main/viacurl. These sources are recognized as part of the vendor's own infrastructure. - [REMOTE_CODE_EXECUTION]: Several components are installed by piping remote scripts directly into
bash. For example,bash <(curl -s https://raw.githubusercontent.com/hummingbot/skills/main/skills/hummingbot-deploy/scripts/check_env.sh). While this is an invasive pattern, the scripts originate from the vendor's own trusted GitHub repository. - [COMMAND_EXECUTION]: The skill executes various system commands to manage the deployment, including
make setup,make deploy, anddocker compose. It also manages environment configuration by writing to.envfiles and creating local shims if needed in containerized environments.
Audit Metadata