claude-skills-library-expert
Fail
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documents an installation method for OpenClaw using the command 'bash <(curl -s https://raw.githubusercontent.com/alirezarezvani/claude-skills/main/scripts/openclaw-install.sh)'. This pattern directly executes remote code on the user's system without prior inspection or verification, which is a critical security risk.- [EXTERNAL_DOWNLOADS]: Instructions throughout the skill encourage users to clone a third-party GitHub repository ('alirezarezvani/claude-skills') and execute various internal scripts like 'gemini-install.sh', 'convert.sh', and 'install.sh'. This introduces a substantial supply chain risk as the executed code is not verified.- [COMMAND_EXECUTION]: The documentation suggests making downloaded third-party scripts executable using 'chmod +x' and performing installations with the '--force' flag. These practices bypass standard safety checks and can lead to unintended system modifications or the execution of malicious logic contained within the external repository.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/alirezarezvani/claude-skills/main/scripts/openclaw-install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata