cve-source-check
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (
scripts/check-cve-sources.py) to perform its core auditing logic. This is the primary intended function of the skill. - [EXTERNAL_DOWNLOADS]: When the
--check-urlsflag is provided, the script performs HTTP HEAD requests to verify the reachability of vulnerability feed URLs defined in thetech-source-registry.jsonfile. - The target URLs belong to well-known and trusted technology organizations and services, including GitHub, Google, Python.org, Nodejs.org, Oracle, Debian, Ubuntu, Apache, and others.
- These requests are best-effort, time-limited (5-second timeout), and do not involve downloading full content or executing remote scripts.
- [SAFE]: The skill uses standard Python libraries, follows best practices for secret management (no hardcoded credentials), and does not exhibit any patterns of obfuscation, privilege escalation, or persistence.
Audit Metadata