cli-anything-eth2-quickstart
Fail
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill is designed to execute shell scripts contained within the
chimera-defi/eth2-quickstartrepository. These scripts handle critical tasks such as client installation and node bootstrapping, effectively executing external logic on the host system. - [EXTERNAL_DOWNLOADS]: The skill's primary function is dependent on an external codebase from the
chimera-defiGitHub organization. The skill requires a local checkout of this repository to operate, introducing a dependency on unverified third-party scripts. - [COMMAND_EXECUTION]: Several core commands (
install-clients,setup-node,start-rpc) directly trigger shell scripts that modify system configurations, install packages, and manage network services like Nginx or Caddy. These operations typically require elevated privileges and can significantly alter the host environment. - [DATA_EXFILTRATION]: While the skill claims to handle validator metadata only, the
configure-validatorcommand processes Ethereum addresses and graffiti strings. While no direct exfiltration was detected, the combination of network configuration (start-rpc) and identity metadata processing creates a potential surface for exposure if the underlying scripts are compromised.
Recommendations
- AI detected serious security threats
Audit Metadata