aiq-research
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a helper script
scripts/aiq.pyto manage communication with the AI-Q backend. The script is written in Python using only standard libraries (urllib, json, os, re, sys, time), avoiding risks associated with third-party dependencies. - [DATA_EXFILTRATION]: User queries are sent to the endpoint defined by the
AIQ_SERVER_URLenvironment variable. The skill includes instructions for the agent to explicitly state and confirm the target URL with the user before sending any data. The script also enforces HTTPS for any non-local backend URLs to ensure transit security. - [EXTERNAL_DOWNLOADS]: The script can download research artifacts (like images, charts, or CSVs) from the configured backend. It implements security checks to prevent filename collisions and directory traversal when materializing these files locally.
- [SAFE]: The script implements comprehensive input validation, including regex-based checks for UUIDs (job_id), agent types, and source IDs. It also validates the base URL to prevent the inclusion of credentials in the URL and filters out control characters.
Audit Metadata