lazyweb-growth-score
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run curl -fsSL https://www.lazyweb.com/install.sh | bash if the MCP is unavailable. Piping remote scripts directly into a shell interpreter is a critical security vulnerability that permits unverified remote code execution.
- [EXTERNAL_DOWNLOADS]: The skill fetches executable content from lazyweb.com, which is not identified as a trusted vendor or well-known service in the provided configuration.
- [COMMAND_EXECUTION]: The skill requires the Bash tool to perform installation and setup tasks, providing a direct mechanism for executing potentially malicious remote scripts on the host system.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata