iii-getting-started
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to install the iii engine by piping a remote script directly to the shell:
curl -fsSL https://install.iii.dev/iii/main/install.sh | sh. While this is a common installation pattern for CLI tools from their official vendor, it remains a high-privilege execution vector. - [EXTERNAL_DOWNLOADS]: The skill requires downloading multiple external dependencies and tools:
- SDK packages (
iii-sdk,@iii-dev/helpers,iii-helpers) are fetched from NPM, PyPI, and Cargo. - Additional agent skills are retrieved from a remote repository using
npx skills add iii-hq/iii/skills. - [COMMAND_EXECUTION]: The instructions involve executing several local commands for project lifecycle management, including
iii create,iii compose, andiii trigger. - [INDIRECT_PROMPT_INJECTION]: The worker implementation examples in TypeScript, Python, and Rust establish a surface for processing untrusted data.
- Ingestion points: Data enters via the
inputordataparameters in functions registered to HTTP triggers in SKILL.md. - Boundary markers: There are no markers or delimiters shown in the examples to isolate data from potential instructions.
- Capability inventory: The functions demonstrate logging capabilities and returning data to the caller.
- Sanitization: The code snippets directly access input fields without demonstrating validation or sanitization, representing a standard entry point for untrusted content.
Recommendations
- HIGH: Downloads and executes remote code from: https://install.iii.dev/iii/main/install.sh - DO NOT USE without thorough review
Audit Metadata