skills/lev-os/agents/tribunal/Gen Agent Trust Hub

tribunal

Warn

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple external AI CLI tools using subprocess.Popen in bin/detect-runners. It dispatches commands like codex debug models, agy models, and cursor-agent models to discover reachable models. In the SKILL.md instructions, it also guides the agent to launch concurrent processes for each (runner, model) pair, potentially triggering a large number of external executions.
  • [EXTERNAL_DOWNLOADS]: The skill relies on and interacts with various external AI CLI tools (Codex, Claude Code, Gemini CLI, Aider, etc.). Although it does not download these tools directly, it is designed to discover and invoke them if they are present on the host system.
  • [DYNAMIC_EXECUTION]: The Python script bin/detect-runners uses a ThreadPoolExecutor to concurrently map the detect_runner function across a list of runner specifications. This dynamically probes the system for installed binaries and executes their discovery commands to build a runtime model catalog.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 27, 2026, 07:20 AM
Security Audit — agent-trust-hub — tribunal