configure-ecc
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute various command-line operations, including
claude plugin list,codex plugin add, and executing local setup scripts to configure the plugin environment. - [EXTERNAL_DOWNLOADS]: The skill commands the agent to use
npx --yes --package ecc-universalto download and run an unpinned package from the public npm registry, presenting a supply-chain risk if the package is compromised or typosquatted. - [DYNAMIC_EXECUTION]: The skill utilizes inline Node.js execution via
node -ewith arguments interpolated at runtime. It implements a defensive check requiring validation againstECC_VERSION_PATTERNto minimize command injection vulnerabilities.
Audit Metadata