skills/jeecgboot/skills/jeecg-aiflow/Gen Agent Trust Hub

jeecg-aiflow

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file scripts/aiflow_apis.py contains a hardcoded string _SIGN_SECRET = "dd05f1c54d63749eda95f9fa6d49v442a". This is used for MD5 signing of API requests as required by the target platform. This value is a standard default constant within the JeecgBoot framework protocol.
  • [COMMAND_EXECUTION]: The skill performs network operations using the Python urllib library to communicate with the backend API at a user-defined endpoint. It also manages its own state by reading and writing JSON configuration files in a dedicated temporary directory.
  • [COMMAND_EXECUTION]: The skill uses dynamic module loading in scripts/nodes/__init__.py to import node templates from its own subdirectories. This behavior is restricted to the skill's internal package structure.
  • [COMMAND_EXECUTION]: The skill utilizes dynamic context injection in SKILL.md to run a local script (gen_node_options_index.py) at load time. This is used for generating documentation indices and is a benign use of the platform's dynamic execution features.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 09:06 AM
Security Audit — agent-trust-hub — jeecg-aiflow