debugging-signals-pipeline

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous commands for local development and debugging, including python manage.py tasks for signal management, docker commands for container inspection, and curl commands for database interaction. These are standard operations for the described debugging purpose.
  • [EXTERNAL_DOWNLOADS]: The skill uses curl to interact with local REST APIs on localhost:8081 (Temporal) and localhost:8123 (ClickHouse). While these are network operations, they target the local machine to retrieve status and debug data.
  • [REMOTE_CODE_EXECUTION]: Automated scanners flagged two patterns where curl output is piped to python3. However, manual analysis confirms these are benign data processing patterns: curl ... | python3 -c "...". In these cases, the Python interpreter is used to parse and format JSON data retrieved from the local API using a static script provided in the command line argument. The content retrieved from the URL is treated as data (via json.load(sys.stdin)), not as executable code.
  • [DATA_EXPOSURE]: The skill includes instructions to grep the .env file for configuration settings and read logs from local object storage. These actions are within the scope of a local debugging utility and do not involve exfiltration to external domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 03:59 PM
Security Audit — agent-trust-hub — debugging-signals-pipeline