forge-payments
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a Node.js script using a relative path that escapes the skill's package directory:
node ../../../.fullstack-forge/runtime/cli/src/composition-entry.js. - [COMMAND_EXECUTION]: Instructions specify running the CLI commands
forge doctorandforge update allfor installation maintenance and updates. - [REMOTE_CODE_EXECUTION]: The
forge update allcommand suggests a mechanism that retrieves and executes code from remote sources during the update process. - [EXTERNAL_DOWNLOADS]: The software update instructions imply that the tool will connect to external network resources to download components.
- [COMMAND_EXECUTION]: The skill uses directory traversal (
../../../) to load a 'canonical playbook' and other resources from a location outside its own folder structure.
Audit Metadata