get-available-resources

Warn

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The script resource-lister.py executes numerous system commands and external binaries (e.g., pip3, psql, redis-cli, fluent, matlab) using subprocess.run to verify installation status and versions.\n- [CREDENTIALS_UNSAFE]: The tool specifically probes for the DATABASE_URL environment variable, which frequently contains sensitive credentials such as usernames and passwords in plaintext connection strings.\n- [DATA_EXFILTRATION]: The skill gathers extensive reconnaissance data about the host environment, including OS details, architecture, disk/memory usage, and specific tool paths, making this information available to the AI agent's context.\n- [COMMAND_EXECUTION]: The function check_package_installed in resource-lister.py uses __import__() to check for module presence. The --check argument allows arbitrary module names to be passed, potentially leading to the execution of code within local modules or triggering side effects during the import process.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 6, 2026, 11:23 PM
Security Audit — agent-trust-hub — get-available-resources