openduck-distributed-duckdb
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download source code from an external repository located at
https://github.com/CITGuru/openduck, which is not a verified or well-known service provider in this context. - [REMOTE_CODE_EXECUTION]: Users are directed to compile and execute the downloaded source code using
cargo build,make, andcargo run. Running build commands on code from an unverified third-party repository introduces the risk of arbitrary code execution during the compilation process. - [COMMAND_EXECUTION]: The instructions recommend setting the DuckDB configuration
allow_unsigned_extensionstotrue. This action deliberately bypasses the signature verification security layer intended to protect users from loading malicious or unauthorized binary extensions.
Audit Metadata