lazyweb-search-screens
Fail
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to execute
curl -fsSL https://www.lazyweb.com/install.sh | bash. This pattern is highly dangerous as it fetches code from the internet and executes it with shell privileges without any integrity verification or content inspection.- [EXTERNAL_DOWNLOADS]: The skill depends on a script hosted on an external domain (www.lazyweb.com) that is not recognized as a trusted organization or well-known service.- [COMMAND_EXECUTION]: The skill requires theBashtool and instructs the agent to run installation scripts and health check commands, providing a path for potential system compromise if the remote script is malicious.- [PROMPT_INJECTION]: The skill ingests untrusted data from thelazyweb_search_screenstool and uses it to guide refinements and subsequent searches without explicit boundary markers or sanitization. - Ingestion points: Results from
lazyweb_search_screens(SKILL.md). - Boundary markers: Absent.
- Capability inventory: Bash execution, search refinement, health checks.
- Sanitization: None identified.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata