rs-soroban-sdk
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- REMOTE_CODE_EXECUTION (CRITICAL): The skill utilizes a piped shell execution pattern (
curl | sh) to install the Stellar CLI from an untrusted remote source. - Evidence: Automated scanner detected
curl -fsSL https://github.com/stellar/stellar-cli/raw/main/install.sh | sh. - Risk: This pattern allows for the execution of arbitrary code with user privileges without prior verification or manual review.
- EXTERNAL_DOWNLOADS (HIGH): The skill downloads and executes a script from the
stellarGitHub organization. - Trust Status: Per [TRUST-SCOPE-RULE], the
stellarorganization is not in the defined list of trusted entities. Therefore, downloading and executing content from this source is treated as a high-severity finding. - COMMAND_EXECUTION (HIGH): The skill facilitates the execution of shell commands based on remote content.
- Evidence: The use of
shto process the output of a network request viacurl.
Recommendations
- CRITICAL: Downloads and executes remote code from untrusted source(s): https://github.com/stellar/stellar-cli/raw/main/install.sh - DO NOT USE
- AI detected serious security threats
Audit Metadata