implementing-zero-trust-with-hashicorp-boundary

Fail

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [CREDENTIALS_UNSAFE]: The SKILL.md file contains hardcoded credentials within HCL configuration examples, specifically a database password in a connection string (postgresql://boundary:password@localhost:5432/boundary) and several static AEAD encryption keys used for root, worker authentication, and recovery purposes.\n- [COMMAND_EXECUTION]: The script scripts/agent.py executes the boundary binary through the subprocess.run function. The script dynamically constructs command arguments from user input, which is essential for its auditing functionality. Additionally, it uses __import__ to dynamically load the os module for environment management during command execution.\n- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download software and GPG keys from apt.releases.hashicorp.com, which is an official repository for HashiCorp products.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 11, 2026, 09:00 AM