forge-payments

Warn

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script using a relative path that escapes the skill's package directory: node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js.
  • [COMMAND_EXECUTION]: Instructions specify running the CLI commands forge doctor and forge update all for installation maintenance and updates.
  • [REMOTE_CODE_EXECUTION]: The forge update all command suggests a mechanism that retrieves and executes code from remote sources during the update process.
  • [EXTERNAL_DOWNLOADS]: The software update instructions imply that the tool will connect to external network resources to download components.
  • [COMMAND_EXECUTION]: The skill uses directory traversal (../../../) to load a 'canonical playbook' and other resources from a location outside its own folder structure.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 6, 2026, 06:48 PM
Security Audit — agent-trust-hub — forge-payments