shareful-init
Warn
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION] (MEDIUM): The skill instructs the agent to run
npx shareful-ai, which downloads and executes code from the npm registry at runtime. The package is not from a trusted source. - [EXTERNAL_DOWNLOADS] (MEDIUM): Relies on the execution of code downloaded from the npm registry without version pinning or source verification.
- [DATA_EXFILTRATION] (LOW): The
npx shareful-ai registercommand is used to send repository metadata to an external service (shareful.ai) for indexing. - [COMMAND_EXECUTION] (MEDIUM): The skill requires the execution of multiple shell commands, including
git,gh(GitHub CLI), andnpx, and modifies a configuration file at~/.shareful/config.json.
Audit Metadata