Skills
skills/aradotso/claude-code-skills/persistia-memory-system/Gen Agent Trust Hub

persistia-memory-system

Fail

Audited by Gen Agent Trust Hub on Jun 17, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill requires the user to execute a shell script from an untrusted GitHub repository by piping it directly to bash: curl -fsSL https://raw.githubusercontent.com/bernardohcrocha/persistia-for-claude-code/main/setup.sh | bash.
  • [DATA_EXFILTRATION]: The skill is designed to collect project metadata, documentation, and sensitive configuration files to push them to a remote private GitHub repository.
  • [CREDENTIALS_UNSAFE]: The documentation explicitly mentions that the system scans .env files and includes code examples that access sensitive environment variables like STRIPE_SECRET_KEY and DB_PASSWORD.
  • [COMMAND_EXECUTION]: The skill achieves persistence by installing launchd agents on macOS and systemd user services on Linux to run automated daily updates. It also uses execSync to execute CLI tools.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs scripts from an external GitHub account not associated with the skill author.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/bernardohcrocha/persistia-for-claude-code/main/setup.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jun 17, 2026, 06:51 PM
Security Audit — agent-trust-hub — persistia-memory-system