ax
Fail
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill frequently instructs the user and agent to install the 'ax' tool by running
curl -fsSL https://ax.yusuke.run/install | sh, which executes a remote script without verification. - [EXTERNAL_DOWNLOADS]: The
setup.shscript downloads platform-specific binaries fromhttps://ax.yusuke.run/download/and makes them executable on the local system. - [COMMAND_EXECUTION]: The skill uses
subprocess.runandchild_process.execto interact with the system shell to execute theaxtool. - [PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection due to its core function of fetching and processing untrusted web data.
- Ingestion points: Untrusted web content fetched via
ax <url>(SKILL.md). - Boundary markers: Use of
--outlinefor structure discovery and--budgetfor token capping (SKILL.md). - Capability inventory: Shell command execution capabilities via the
axCLI wrappers (tools/ax_tool.py, tools/ax-tool.js). - Sanitization: No explicit sanitization of the fetched web data is performed before it is presented to the agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://ax.yusuke.run/install - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata