deps-vet

Fail

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill is designed to download and evaluate remote Elixir scripts using Code.eval_file/1 for its distributed imports feature.
  • Evidence: references/hex-vet.md describes fetching remote ledger files via curl -fsSL and evaluating them directly with the Elixir compiler to process the audit maps.
  • [EXTERNAL_DOWNLOADS]: The skill fetches curated audit seeds and package metadata from external repositories and registries.
  • Evidence: The skill interacts with raw.githubusercontent.com/oliver-kriska/... to retrieve baseline audits and references hex.pm for package information.
  • [COMMAND_EXECUTION]: The skill executes shell scripts and uses Elixir's runtime to perform file manipulations.
  • Evidence: SKILL.md invokes a bash script (fetch.sh) and uses mix run -e to programmatically update the hex_vet.exs ledger file by evaluating and formatting Elixir terms.
  • [DATA_EXFILTRATION]: The skill extracts personal identification information (PII) from the local environment and records it in a file intended for sharing.
  • Evidence: SKILL.md Step 7 and the 'Append flow' in references/hex-vet.md demonstrate the use of git config user.email to identify the reviewer, which is then persisted in the hex_vet.exs artifact alongside the project source code.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 30, 2026, 02:01 PM
Security Audit — agent-trust-hub — deps-vet