cli-tools
Warn
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively uses shell commands to audit the environment, check tool versions, and manage software packages. This includes the use of
sudoinscripts/auto_update.shfor system-wide updates (APT, Snap) and inscripts/lib/install_strategy.shfor installing tools to protected directories like/usr/local/bin. - [EXTERNAL_DOWNLOADS]: Multiple scripts, including
github_release_binary.sh,hashicorp_zip.sh, andaws_installer.sh, usecurlto fetch binaries, archives, and version metadata from external repositories such as GitHub, GitLab, and HashiCorp. The target URLs are dynamically resolved from tool catalog files. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of remote code by downloading installers and running them locally. For instance,
aws_installer.shdownloads and executes the AWS CLI installation script, whileinstall_composer.shdownloads and runs a PHP archive (composer.phar). Additionally,dedicated_script.shdynamically executes shell scripts specified in the tool catalog. - [PERSISTENCE]: The
path_check.shlibrary implements functionality to modify user shell configuration files (e.g.,.bashrc,.zshrc,.profile). It appends PATH exports and shell integration hooks (e.g.,eval "$(zoxide init bash)") to ensure that installed tools are persistent across shell sessions. It also injects a helper function_eval_ifinto these configuration files. - [COMMAND_EXECUTION]: The
scripts/auto_update.shscript executes batch update commands for numerous package managers (NPM, Pip, Cargo, Go, etc.), often performing self-updates of the package managers themselves.
Audit Metadata