Skills
skills/agoodway/goodskills/bootstrap-zig-cli/Gen Agent Trust Hub

bootstrap-zig-cli

Fail

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides explicit instructions to install the openapi2zig tool by downloading a script from https://christianhelle.com/openapi2zig/install and piping it directly into bash. This 'curl | bash' pattern is a severe security risk as it executes unverified remote code with the user's shell privileges from an untrusted domain.\n- [COMMAND_EXECUTION]: The skill directs the agent to perform extensive shell operations including directory creation (mkdir), project initialization (zig init), and build tasks (zig build). Additionally, it references a hardcoded local file path (/Users/tbrewer/projects/goodway/henry/cli-zig/) as a reference implementation, which constitutes an information leak and could lead to unauthorized file access attempts or execution failures if the agent tries to read paths from the author's local environment.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of software from unverified external domains and provides installer templates (install.sh and install.ps1) designed to fetch binaries from remote GitHub repositories.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jun 16, 2026, 04:16 AM
Security Audit — agent-trust-hub — bootstrap-zig-cli