ai-chatbot
Warn
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches source code from a repository at
https://github.com/Eng0AI/ai-chatbot-template.git. This repository is not associated with a trusted organization or well-known service. - [COMMAND_EXECUTION]: The instructions involve executing several shell commands, including
pnpm installandpnpm db:migrate, which run scripts from the downloaded, unverified repository. - [DATA_EXFILTRATION]: The deployment instructions include a script that reads all keys and values from the
.envfile (which contains sensitive credentials likePOSTGRES_URLandAPI_KEYs) and transmits them to Vercel or Netlify via their respective CLI tools. While these are well-known services, the process involves the automated handling and transmission of raw secrets.
Audit Metadata