purgetss
Warn
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates potential privilege escalation through the
purgetss sudo-update(aliassu) command, which is documented to executesudo npm install -g purgetssto manage global tool updates. - [COMMAND_EXECUTION]: The skill implements a persistence and automated execution mechanism via the
purgetss watchcommand. This utility modifies the project'salloy.jmkfile to inject apre:compiletask that runsrequire('child_process').execSync('purgetss', ...)every time the application is compiled. - [REMOTE_CODE_EXECUTION]: Multiple commands provided by the skill, such as
purgetss createandpurgetss install-dependencies, trigger the execution ofnpm install. This process involves downloading and running code from external registries at runtime. - [EXTERNAL_DOWNLOADS]: The skill provides functionality to fetch assets like icon fonts and development configuration files from various external sources, including GitHub and font provider domains.
Audit Metadata