example-hello-world
Fail
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to download a shell script from a remote GitHub repository and pipe it directly into the shell (
curl ... | sh) to install the Compact compiler. This pattern bypasses local security checks and executes unverified remote code. - [CREDENTIALS_UNSAFE]: The file
src/providers.tscontains a hardcoded password string ('xK9#mQ2$pL8@nR5!vW3*') used for a private storage password provider. While part of a template, hardcoding secrets is a security anti-pattern. - [COMMAND_EXECUTION]: The
compose.ymlfile contains a healthcheck commandecho > /dev/tcp/127.0.0.1/6300. This uses raw bash socket syntax which is often associated with reverse shells or network probing, although here it is used for a local service check. - [EXTERNAL_DOWNLOADS]: The skill downloads multiple external Docker images from the
midnightntwrkorganization and pulls the compiler installer from GitHub.
Recommendations
- AI detected serious security threats
Audit Metadata