skills/muratcankoylan/agent-skills-for-context-engineering/context-engineering-collection/Gen Agent Trust Hub
context-engineering-collection
Warn
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
examples/interleaved-thinking/examples/03_full_optimization.pyimplements a calculator tool using theeval()function on user-supplied strings. While it attempts to use a restricted global environment, this remains a high-risk code injection vector. - [COMMAND_EXECUTION]: The shell script
examples/digital-brain-skill/scripts/install.shperforms filesystem operations, including directory creation and moving files into the user's local.claude/skillsdirectory, which modifies the agent's execution environment. - [COMMAND_EXECUTION]: Reference implementations in
skills/hosted-agents/references/infrastructure-patterns.mddemonstrate usingos.systemto execute git commands populated with user-supplied identity strings (name/email), presenting a potential command injection surface if the inputs are not strictly validated. - [EXTERNAL_DOWNLOADS]: Root documentation and individual skill files (e.g.,
README.md,skills/filesystem-context/SKILL.md) provide instructions to download external content usingcurlfromraw.githubusercontent.comfor manual installation of skills.
Audit Metadata