openydt-coupon
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
openydtCLI binary to perform all its operations, including creating, modifying, and deleting merchant and coupon data. All write operations require a--yesflag as a safety confirmation mechanism. - [CREDENTIALS_UNSAFE]: The
validate-trader-account-and-passwordcommand accepts a--trader-passwordparameter in cleartext. While this is standard for the documented administrative functionality, handling passwords in CLI arguments is a sensitive operation. - [DATA_EXFILTRATION]: The
lock-couponcommand accepts a--urlparameter. Depending on the implementation of theopenydtbinary, this could lead to outbound network requests, which is an expected part of the described 'coupon locking' workflow but remains a potential vector for external communication.
Audit Metadata