skills/affaan-m/ecc/configure-ecc/Gen Agent Trust Hub

configure-ecc

Warn

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute various command-line operations, including claude plugin list, codex plugin add, and executing local setup scripts to configure the plugin environment.
  • [EXTERNAL_DOWNLOADS]: The skill commands the agent to use npx --yes --package ecc-universal to download and run an unpinned package from the public npm registry, presenting a supply-chain risk if the package is compromised or typosquatted.
  • [DYNAMIC_EXECUTION]: The skill utilizes inline Node.js execution via node -e with arguments interpolated at runtime. It implements a defensive check requiring validation against ECC_VERSION_PATTERN to minimize command injection vulnerabilities.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 14, 2026, 11:07 PM
Security Audit — agent-trust-hub — configure-ecc