lazyweb-search-experiments
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instructions explicitly direct the agent to execute
curl -fsSL https://www.lazyweb.com/install.sh | bash. This pattern downloads a script from a remote server and executes it directly in the local environment without any verification or human review. - [EXTERNAL_DOWNLOADS]: The skill fetches executable content from
www.lazyweb.com, which is not identified as a trusted or well-known provider in the internal context. - [COMMAND_EXECUTION]: The skill leverages the
Bashtool to run administrative commands (curl,bash) for environment setup, which can be exploited if the remote source is compromised.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata