documentation
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Remote Code Execution (HIGH): The
CONTRIBUTING.mdsection of the skill includes a template that instructs the agent or user to execute a remote script by pipingcurloutput directly tosh. This pattern is a major security risk as it allows for arbitrary execution of remote code without verification. - Evidence:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | shinSKILL.md. - Malicious URL (LOW): Automated scanners flagged the string
client.doas a phishing risk. - Evidence: Found in code example
client.do_something(). - Analysis: This is a false positive. The scanner likely flagged the
.dotop-level domain appearing in a standard method name. No malicious intent is found in this specific instance.
Recommendations
- CRITICAL: Downloads and executes remote code from untrusted source(s): https://sh.rustup.rs - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata