jeecg-aiflow
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
scripts/aiflow_apis.pycontains a hardcoded string_SIGN_SECRET = "dd05f1c54d63749eda95f9fa6d49v442a". This is used for MD5 signing of API requests as required by the target platform. This value is a standard default constant within the JeecgBoot framework protocol. - [COMMAND_EXECUTION]: The skill performs network operations using the Python
urlliblibrary to communicate with the backend API at a user-defined endpoint. It also manages its own state by reading and writing JSON configuration files in a dedicated temporary directory. - [COMMAND_EXECUTION]: The skill uses dynamic module loading in
scripts/nodes/__init__.pyto import node templates from its own subdirectories. This behavior is restricted to the skill's internal package structure. - [COMMAND_EXECUTION]: The skill utilizes dynamic context injection in
SKILL.mdto run a local script (gen_node_options_index.py) at load time. This is used for generating documentation indices and is a benign use of the platform's dynamic execution features.
Audit Metadata