Skills
Navigate
skills/yashan-technologies/yashandb-dev-plugins/yashandb-docker/Gen Agent Trust Hub

yashandb-docker

Fail

Audited by Gen Agent Trust Hub on Mar 23, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill defines a hardcoded default password Cod-2022 within its variables for the database system administrator account, which is insecure for production deployments.
  • [EXTERNAL_DOWNLOADS]: The skill pulls Docker images from the third-party mirror docker.1ms.run and downloads image archives from download.yashandb.com and linked.yashandb.com.
  • [REMOTE_CODE_EXECUTION]: The skill downloads binary Docker image archives via curl or Invoke-WebRequest and executes their content by loading them into the Docker daemon and running them.
  • [COMMAND_EXECUTION]: The skill instructs the agent to install system-wide software using sudo apt or sudo yum, granting the process administrative privileges.
  • [COMMAND_EXECUTION]: The skill runs Docker containers with host volume mounts (-v), allowing the containerized environment to read and write to the host's filesystem.
  • [COMMAND_EXECUTION]: The cleanup procedure includes the use of rm -rf to delete local data directories.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 23, 2026, 10:18 AM
Security Audit — agent-trust-hub — yashandb-docker