agenticskills

Fail

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill's primary instruction is to download a shell script from a remote GitHub repository and pipe it directly into bash for execution. This occurs in multiple scenarios, including default installation, platform-specific installation, and re-installation attempts.
  • Evidence: curl -fsSL https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.sh | bash in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill relies on fetching content from external sources (raw.githubusercontent.com) to function. The installer script is hosted outside the skill's own package context.
  • Evidence: References to https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.sh in frontmatter and instructions.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute arbitrary shell commands on the host system, including modifying the filesystem (creating directories in ~/.agent-skills, ~/.claude/skills, etc.) and executing downloaded scripts.
  • Evidence: Use of bash, curl, ls, and environment variable injection (PLATFORM, INSTALL_MODE) to control system-level changes.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/akillness/oh-my-gods/main/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 28, 2026, 01:51 PM
Security Audit — agent-trust-hub — agenticskills