lazyweb-update
Fail
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill contains instructions to download a shell script from
https://www.lazyweb.com/install.shand execute it by piping the output directly tobash. This pattern executes remote code without prior verification of its contents. - [EXTERNAL_DOWNLOADS]: The skill fetches version data and source code from external sources, including
raw.githubusercontent.comand a Git repository athttps://github.com/aboul3ata/lazyweb-skill. It then executes asetupscript located within the downloaded repository. - [COMMAND_EXECUTION]: The skill invokes local binaries (
~/.lazyweb/bin/lazyweb-update) and scripts retrieved from the internet. It also performs file system operations, including searching for and deleting directories, within application-specific paths such as~/.claude/skills,~/.cursor/skills, and~/.agents/skills.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.lazyweb.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata