unsplash
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- REMOTE_CODE_EXECUTION (CRITICAL): The skill utilizes a 'curl | bash' pattern to download and execute installation scripts from 'https://canifi.com/skills/unsplash/install.sh' and 'https://canifi.com/install.sh'. Since this domain is not a trusted source, it constitutes a confirmed critical remote code execution risk.
- EXTERNAL_DOWNLOADS (HIGH): The skill downloads and executes multiple scripts from an untrusted external source ('canifi.com').
- CREDENTIALS_UNSAFE (HIGH): The documentation encourages users to store sensitive 'UNSPLASH_PASSWORD' and 'SERVICE_PASSWORD' credentials in environment variables managed by scripts from an untrusted source, creating a high risk of exfiltration.
- COMMAND_EXECUTION (MEDIUM): The skill relies on local shell command execution ('cp', 'canifi-env') and Playwright automation for core functionality, which can be exploited by the untrusted scripts.
Recommendations
- HIGH: Downloads and executes remote code from: https://canifi.com/skills/unsplash/install.sh, https://canifi.com/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata