agent-apprenticeship-ecosystem
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is configured to pull "experience packs," seed tasks, and execution traces from the
Forsy-AI/agent-apprenticeshipGitHub repository. - [DATA_EXFILTRATION]: The skill provides functionality to "contribute" execution bundles to a remote ecosystem. The
--auto-share automaticconfiguration setting allows for the silent upload of local workspace content, including execution traces, agent rollouts, and generated artifacts, to a remote repository. - [COMMAND_EXECUTION]: The tool executes various agent CLIs (such as Codex, Cursor, and Claude Code) via subprocess calls. It also supports custom agent definitions through command templates (e.g.,
--command-template), which provides a surface for the construction and execution of arbitrary shell commands. - [REMOTE_CODE_EXECUTION]: The installation instructions encourage the use of
npxandnpm install -gfor theagent-apprenticeshippackage, which executes code directly from the public npm registry. Additionally, theapprentice learn replayfunctionality implies the execution of logic contained within pulled experience packs.
Recommendations
- AI detected serious security threats
Audit Metadata