Skills
skills/aradotso/trending-skills/gpt-agreement-payment-replay/Gen Agent Trust Hub

gpt-agreement-payment-replay

Fail

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from an unverified GitHub account (DanOps-1/Gpt-Agreement-Payment). This source does not belong to a recognized trusted organization or the skill author.
  • [REMOTE_CODE_EXECUTION]: The instructions direct the user to run Python scripts (pipeline.py) and a WebUI server directly from the unverified external repository, which could execute arbitrary code on the host system.
  • [COMMAND_EXECUTION]: The installation process requires sudo privileges to install system-level packages including xvfb and gost. The use of gost (a tunneling tool) and xvfb-run (headless display) is often associated with obfuscating automated bot activities.
  • [CREDENTIALS_UNSAFE]: The skill requires the user to store extremely sensitive credentials in plain-text configuration files or environment variables. This includes PayPal email and password, TOTP secrets, Cloudflare API tokens, Zone IDs, and various service API keys.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 30, 2026, 01:06 PM