fabro-workflow-factory
Fail
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides installation commands that pipe a remote script directly to the bash shell (
curl -fsSL https://fabro.sh/install.sh | bash). This practice allows for arbitrary code execution from a domain that is not recognized as a trusted source. - [EXTERNAL_DOWNLOADS]: Remote content from
https://fabro.sh/install.mdis piped directly into the AI agent (| claude) or dynamic execution tools (codex). This method can be used to inject malicious instructions or commands into the agent's workflow. - [COMMAND_EXECUTION]: The troubleshooting section instructs users to modify shell configuration files (
~/.bashrc,~/.zshrc) to add the tool to the system path. In combination with unverified installation scripts, this can be leveraged as a persistence mechanism for malicious payloads.
Recommendations
- HIGH: Downloads and executes remote code from: https://fabro.sh/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata