cli-tools

Warn

Audited by Gen Agent Trust Hub on Mar 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses shell commands to audit the environment, check tool versions, and manage software packages. This includes the use of sudo in scripts/auto_update.sh for system-wide updates (APT, Snap) and in scripts/lib/install_strategy.sh for installing tools to protected directories like /usr/local/bin.
  • [EXTERNAL_DOWNLOADS]: Multiple scripts, including github_release_binary.sh, hashicorp_zip.sh, and aws_installer.sh, use curl to fetch binaries, archives, and version metadata from external repositories such as GitHub, GitLab, and HashiCorp. The target URLs are dynamically resolved from tool catalog files.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by downloading installers and running them locally. For instance, aws_installer.sh downloads and executes the AWS CLI installation script, while install_composer.sh downloads and runs a PHP archive (composer.phar). Additionally, dedicated_script.sh dynamically executes shell scripts specified in the tool catalog.
  • [PERSISTENCE]: The path_check.sh library implements functionality to modify user shell configuration files (e.g., .bashrc, .zshrc, .profile). It appends PATH exports and shell integration hooks (e.g., eval "$(zoxide init bash)") to ensure that installed tools are persistent across shell sessions. It also injects a helper function _eval_if into these configuration files.
  • [COMMAND_EXECUTION]: The scripts/auto_update.sh script executes batch update commands for numerous package managers (NPM, Pip, Cargo, Go, etc.), often performing self-updates of the package managers themselves.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 16, 2026, 02:20 PM