Skills
Navigate
skills/nickthelegend/canton-agent-skills/canton-daml-sdk/Gen Agent Trust Hub

canton-daml-sdk

Fail

Audited by Gen Agent Trust Hub on Jun 25, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The installation instructions for Mac and Linux systems involve downloading a script from a remote URL and piping it directly to the shell for execution. Evidence: curl https://get.digitalasset.com/install/install.sh | sh found in the installation section of SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill directs users and agents to fetch installers and scripts from the get.digitalasset.com domain, which is an external source for executable content. Evidence: References to get.digitalasset.com for both shell scripts and Windows installers.
  • [COMMAND_EXECUTION]: The skill defines a large number of command-line operations that the agent is expected to execute locally using the dpm CLI tool. Evidence: Commands such as dpm init, dpm new, dpm build, dpm test, and dpm sandbox are provided as primary instructions.
Recommendations
  • HIGH: Downloads and executes remote code from: https://get.digitalasset.com/install/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 25, 2026, 11:16 AM
Security Audit — agent-trust-hub — canton-daml-sdk