exe-dev
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/exe.tsuses thesshbinary to communicate with theexe.devservice and perform management tasks. It uses Bun's shell execution mechanism which safely handles argument escaping to prevent local command injection. - [EXTERNAL_DOWNLOADS]: The skill facilitates communication with the external service
exe.devand provides access to virtual machines hosted on*.exe.xyzdomains. These interactions are central to the skill's stated purpose of VM management. - [REMOTE_CODE_EXECUTION]: The skill includes an
sshsubcommand that allows the agent or user to execute arbitrary commands on remote virtual machines. While this is a high-privilege capability, it is the intended primary function of the tool and is clearly documented. - [CREDENTIALS_UNSAFE]: The skill manages paths to SSH private keys for authentication with the
exe.devservice. These paths are stored locally in the user's home directory (~/.config/exe-dev/accounts.json). The skill does not hardcode or exfiltrate these credentials.
Audit Metadata