alife
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- EXTERNAL_DOWNLOADS (MEDIUM): The skill references and encourages the installation of numerous Python and Julia packages from unverified sources (e.g., cax, leniax, evotorch). While one source (anthropics/skills) is on the trusted list, the majority are personal repositories without version pinning or integrity hashes.
- COMMAND_EXECUTION (MEDIUM): The LIBRARIES.md file contains an installation script and specific instructions to perform 'git clone' followed by 'make install'. Executing a Makefile from an unverified remote repository is a high-risk operation that can lead to arbitrary code execution on the host system.
- INDIRECT_PROMPT_INJECTION (LOW): The file conversion_status.json represents an ingestion surface for untrusted external data (PDF conversion metadata). 1. Ingestion points: conversion_status.json. 2. Boundary markers: absent. 3. Capability inventory: subprocess execution via pip/git/make in LIBRARIES.md. 4. Sanitization: absent.
- DYNAMIC_EXECUTION (MEDIUM): The installation instructions include 'julia -e', which executes a string directly as code. While used for package management here, the pattern of executing strings as code is a risk factor for dynamic execution vulnerabilities.
Audit Metadata