agenticskills
Fail
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's primary instruction is to download a shell script from a remote GitHub repository and pipe it directly into
bashfor execution. This occurs in multiple scenarios, including default installation, platform-specific installation, and re-installation attempts. - Evidence:
curl -fsSL https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.sh | bashinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill relies on fetching content from external sources (
raw.githubusercontent.com) to function. The installer script is hosted outside the skill's own package context. - Evidence: References to
https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.shin frontmatter and instructions. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute arbitrary shell commands on the host system, including modifying the filesystem (creating directories in~/.agent-skills,~/.claude/skills, etc.) and executing downloaded scripts. - Evidence: Use of
bash,curl,ls, and environment variable injection (PLATFORM,INSTALL_MODE) to control system-level changes.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.sh - DO NOT USE without thorough review
Audit Metadata