lazyweb-quick-references

Fail

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill directs users to 'https://lazyweb.com/#pricing' to obtain an installation command for the agent. Encouraging users to copy-paste unvetted commands into the agent environment is a major security risk.\n- [COMMAND_EXECUTION]: The skill contains logic to locate and execute an external binary called 'browse' from multiple paths, including the user's home directory. It also suggests running a './setup' script located in those directories.\n- [EXTERNAL_DOWNLOADS]: The skill uses 'curl' to download assets from arbitrary image URLs returned by search results, allowing for unverified file downloads into the local system.\n- [CREDENTIALS_UNSAFE]: The skill reads '~/.lazyweb/libraries.json', a configuration file in the user's home directory that is used to manage session states and credentials for external design libraries.\n- [COMMAND_EXECUTION]: The skill automatically runs the 'open' command to display a generated HTML report, which triggers the execution of the system's default file handler for the report file.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
May 2, 2026, 09:55 PM