installing-skills
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads repository structures and skill definition files from GitHub's official API (
api.github.com) and raw content domains (raw.githubusercontent.com). - [COMMAND_EXECUTION]: The skill executes a local shell script (
install.sh) that uses standard tools likecurl,mkdir, andgrepto manage the local file system and network requests. - [REMOTE_CODE_EXECUTION]: The skill fetches instruction sets (
SKILL.mdfiles) from a remote repository and places them into the agent's active skills directory. This effectively imports remote logic into the agent's execution environment. However, the source is the author's own repository on a well-known service.
Audit Metadata