pyre-code-ml-practice
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The installation instructions direct the agent/user to clone an external repository (
https://github.com/whwangovo/pyre-code.git) and execute a local shell script (setup.sh). This sequence downloads and runs third-party code on the host machine without integrity verification. - [DYNAMIC_EXECUTION]: The documentation for 'Adding a New Problem' includes a Python template for a
gradefunction that utilizes theexec()function to run user-supplied code strings (exec(submission_code, namespace)). This architecture allows for arbitrary code execution within the grading service's environment, posing a critical security risk if not properly sandboxed. - [COMMAND_EXECUTION]: The skill documentation includes multiple shell commands for environment setup, package installation (
npm install,pip install), and service execution (uvicorn,docker compose) that operate on the host system or within containers.
Recommendations
- AI detected serious security threats
Audit Metadata