tax-ui-visualizer
Fail
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The Python template provided by the skill utilizes
subprocess.Popenwithshell=True. Invoking the shell directly is a high-risk practice that increases susceptibility to command injection attacks.\n- [COMMAND_EXECUTION]: The generated Python code directly interpolates user input from a GUI text entry into a shell command string:cmd = f'antigravity "{prompt}"'. Because the input is not sanitized or escaped, an attacker or a malicious string could break out of the intended command (e.g., using"; [malicious command] #) to execute arbitrary shell commands on the host system.\n- [EXTERNAL_DOWNLOADS]: The skill's documentation and generated code rely on external Python libraries such ascustomtkinterandpywebview. Users are expected to install these third-party dependencies, which should be verified for safety before installation.
Recommendations
- AI detected serious security threats
Audit Metadata