lazyweb-quick-search
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions include the command
curl -fsSL https://www.lazyweb.com/install.sh | bash. This is a critical security risk as it downloads a remote script and pipes it directly into the bash shell for execution. The content of the remote script is not versioned, verified, or controlled by the agent platform, allowing the source to execute arbitrary code on the underlying system. - [EXTERNAL_DOWNLOADS]: The skill fetches an installation script from
https://www.lazyweb.com. This domain is an external third-party source not identified as a trusted organization or well-known service, and it is not associated with the skill author's verified infrastructure. - [COMMAND_EXECUTION]: The skill provides explicit instructions to execute shell commands for system configuration and health checks (
lazyweb_health), which encourages the agent to perform high-privilege operations outside of standard sandbox constraints.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata