voluum-setup-install
Fail
Audited by Gen Agent Trust Hub on Feb 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- EXTERNAL_DOWNLOADS (HIGH): The skill instructs the user to clone a repository from an untrusted GitHub account (
https://github.com/markab21/voluum-cli.git). This source is not part of the trusted organizations or repositories list. - REMOTE_CODE_EXECUTION (HIGH): Following the download, the skill executes
bun installandbun run build. These commands can trigger arbitrary code execution through lifecycle scripts (preinstall, postinstall) or build scripts defined in the external repository'spackage.jsonfile. - COMMAND_EXECUTION (MEDIUM): The skill uses multiple shell commands to set up the CLI environment, including
git clone,bun link, andvoluum auth, which interact with the system's file structure and environment variables. - CREDENTIALS_UNSAFE (MEDIUM): The skill handles sensitive information including
ACCESS_KEY_ID,ACCESS_KEY, andVOLUUM_TOKEN. Providing these via command-line arguments (voluum auth login --accessKeyId ...) is unsafe as it may leave credentials in the shell's history file. Additionally, it notes that tokens are stored in plain text at~/.voluum-cli/config.json.
Recommendations
- AI detected serious security threats
Audit Metadata