Skills
skills/noorkhalel/saas-ai-skills/security-audit/Gen Agent Trust Hub

security-audit

Warn

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: Several files within the evals/files/ directory contain hardcoded sensitive credentials. evals/files/Dockerfile includes an NPM token (npm_9aFk2LmQ8xZ0pRtVwYbNcDeFgHiJkLmNoPq) and a PostgreSQL connection string. evals/files/main.tf and evals/files/deployment.yaml contain hardcoded database passwords, and evals/files/orders_api.js contains a hardcoded JWT signing secret.
  • [COMMAND_EXECUTION]: The evals/files/agent.py script defines a run_shell tool that executes arbitrary commands using subprocess.run(shell=True). Similarly, evals/files/orders_api.js employs the exec() function to execute shell commands using input derived from request parameters.
  • [REMOTE_CODE_EXECUTION]: The GitHub Actions workflow in evals/files/ci.yml is vulnerable to remote code execution because it uses the pull_request_target event to check out and run code (npm install) from potentially untrusted fork pull requests while having access to repository secrets.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 12, 2026, 07:08 AM
Security Audit — agent-trust-hub — security-audit