digital-research-engine

Fail

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The utility projects/east-africa-property-hostel/tools/build_report.py executes pandoc via subprocess.run to render Markdown research into Word documents. This usage is safe as the command is hardcoded and the arguments are constrained to internal project paths.
  • [EXTERNAL_DOWNLOADS]: Automated detection of blacklisted URLs such as statoids.org and kepsa.or.ke is associated with the skill's primary function of regional market and policy research. These domains represent the Kenya Private Sector Alliance and a known geographic database, both of which are standard reference points for the East African region.
  • [REMOTE_CODE_EXECUTION]: The instruction file skills/scraping-engineering-python/SKILL.md includes an example of using the pickle module for caching. While unpickling data from untrusted sources is a security risk, the skill's production code in tools/scraping/cache.py uses secure json and zlib implementations, neutralizing the actual risk to the agent's environment.
Recommendations
  • Contains 4 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Aug 18, 2026, 09:03 PM
Security Audit — agent-trust-hub — digital-research-engine