lint
Fail
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the dynamic context injection syntax (
!command) to run a shell command that includes the$ARGUMENTSvariable. This variable contains user-provided input that is not sanitized, allowing an attacker to inject arbitrary shell commands (e.g., using;,&&, or|) which will execute on the host machine. - [EXTERNAL_DOWNLOADS]: The command
uvx skilllint@latestfetches the latest version of theskilllintpackage from the Python Package Index (PyPI) and executes it immediately. This behavior introduces a remote code execution risk if the external package is compromised, as the skill does not pin the dependency to a specific, verified version.
Recommendations
- AI detected serious security threats
Audit Metadata