taxue-upgrade
Warn
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata and clones source code from external URLs associated with the author. * Evidence: Uses
curlto retrieve the version fromhttps://raw.githubusercontent.com/taxueseek/taxueskills/main/VERSION. * Evidence: Usesgit cloneto download repository content fromhttps://github.com/taxueseek/taxueskills.git. - [REMOTE_CODE_EXECUTION]: The upgrade logic involves downloading scripts from a remote repository and replacing local skill files, which can change the agent's core instructions and behavior. * Evidence: Clones a remote repository and uses
cp -rto overwrite existing directories in the user's skill paths. - [COMMAND_EXECUTION]: Utilizes various shell commands to manipulate the local file system and suggests modifications to the system's task scheduler. * Evidence: Executes
rm -rfon directories matching thetaxue*pattern during the update process. * Evidence: Recommends adding afindcommand to the user'scrontabto automatically delete old backup directories.
Audit Metadata