genotoxic
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute high-privilege commands (sudo) to install system-level software like Mull, configure platform package repositories, and move binaries to system directories (/usr/local/bin). These actions are required for the installation of the specialized security tooling the skill is designed to manage.
- [EXTERNAL_DOWNLOADS]: The skill manages the download of numerous third-party dependencies and binaries from official and well-known sources, including GitHub (mull-project, trailofbits), Cloudsmith, PyPI, NPM, and Crates.io. These downloads are limited to the mutation frameworks and analysis tools described in the skill's purpose.
- [REMOTE_CODE_EXECUTION]: The documentation includes instructions for setting up tool repositories by piping remote scripts to a shell (curl | bash). These scripts originate from Cloudsmith, a well-known package hosting service, and are used specifically for the Mull project's repository configuration.
- [SAFE]: The core logic of the skill involves analyzing test results against code complexity and reachability metrics computed by the trailmark tool. It maintains a strong security posture by explicitly prohibiting 'manual verification' in favor of systematic tool-based analysis. No indicators of prompt injection, credential harvesting, or suspicious data interpolation were found.
Audit Metadata