Skills
skills/nikiandr/goose-skills/tech-stack-teardown/Gen Agent Trust Hub

tech-stack-teardown

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to call dig for DNS analysis and curl for website source inspection. These calls use list-based arguments, which prevents shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill installs the requests and python-dotenv packages from the standard Python Package Index (PyPI).\n- [DATA_EXFILTRATION]: Domain names are sent to external services including DNS blacklists and the Apify API. This is the intended behavior of the reconnaissance tool and is clearly documented.\n- [SAFE]: Secret management is handled correctly by instructing users to use .env files for the Apify API token instead of hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 05:17 PM