paid-add
Warn
Audited by Gen Agent Trust Hub on Apr 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
lovstudio-activateCLI tool, specifically thedecryptcommand to access the skill's actual logic. - [EXTERNAL_DOWNLOADS]: The documentation requires the user to install an external Python package
lovstudio-activateviapipxornpx skills add lovstudio/skillsto provide the decryption functionality. - [REMOTE_CODE_EXECUTION]: The skill implements a dynamic execution pattern where instructions are fetched from a remote source (via the decryption tool's HTTP round-trip) and followed 'to the letter'. Because these instructions are encrypted and retrieved at runtime, their final behavior cannot be audited beforehand.
- [DATA_EXFILTRATION]: The decryption process involves an HTTP request to the vendor's infrastructure for license verification, which naturally exposes usage metadata and potentially environment context to the vendor's server.
Audit Metadata