lazyweb-ab-test-research
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute a remote installation script using the
curl -fsSL https://www.lazyweb.com/install.sh | bashpattern. Piped execution of remote scripts is a high-risk security practice because it grants an external server the ability to execute arbitrary code on the user's system without prior inspection or verification. - [DATA_EXFILTRATION]: The skill implements a workflow where local files and assets are transmitted to an external domain. Specifically, it reads version information from
~/.lazyweb/VERSIONand collects images from a local references directory, converts them to Base64 strings, and sends them tolazyweb.comvia thelazyweb_render_reporttool. While documented as part of the report-generation process, this establishes a mechanism for exfiltrating local file content to a third-party server. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform file system operations, such as reading from the user's home directory (~/.lazyweb/VERSION). Accessing files within the user's home path (~/) is a sensitive operation that can expose user-specific configuration and metadata.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata