deps-vet
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to download and evaluate remote Elixir scripts using
Code.eval_file/1for its distributed imports feature. - Evidence:
references/hex-vet.mddescribes fetching remote ledger files viacurl -fsSLand evaluating them directly with the Elixir compiler to process the audit maps. - [EXTERNAL_DOWNLOADS]: The skill fetches curated audit seeds and package metadata from external repositories and registries.
- Evidence: The skill interacts with
raw.githubusercontent.com/oliver-kriska/...to retrieve baseline audits and referenceshex.pmfor package information. - [COMMAND_EXECUTION]: The skill executes shell scripts and uses Elixir's runtime to perform file manipulations.
- Evidence:
SKILL.mdinvokes a bash script (fetch.sh) and usesmix run -eto programmatically update thehex_vet.exsledger file by evaluating and formatting Elixir terms. - [DATA_EXFILTRATION]: The skill extracts personal identification information (PII) from the local environment and records it in a file intended for sharing.
- Evidence:
SKILL.mdStep 7 and the 'Append flow' inreferences/hex-vet.mddemonstrate the use ofgit config user.emailto identify the reviewer, which is then persisted in thehex_vet.exsartifact alongside the project source code.
Recommendations
- AI detected serious security threats
Audit Metadata