api-contract-validation
Warn
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.run(shell=True)inscripts/parser.pyto execute shell commands built from strings extracted from the local repository. This includes runningnpmscripts defined inpackage.jsonand executing Django management commands. - [REMOTE_CODE_EXECUTION]: In
scripts/parser.py, the skill attempts to auto-generate API specifications by dynamically importing Python modules from the project being analyzed (e.g.,from main import app). This behavior allows any code present in the analyzed repository to be executed within the agent's environment during the validation process. - [COMMAND_EXECUTION]: The script
scripts/validate.pyaccesses internal platform files includingbazinga/bazinga.dbandbazinga/skills_config.json. It performs SQLite queries on the database to retrieve session IDs, which represents access to platform-level state data.
Audit Metadata