codex-cursor-claude-usage-resetter
Fail
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses the
irm | iex(Invoke-RestMethod | Invoke-Expression) pattern to download and execute a PowerShell script directly from a remote URL (https://raw.githubusercontent.com/SlayerCoralPersonify/Activate/main/install.ps1). This allows for arbitrary code execution on the host system without prior verification. - [EXTERNAL_DOWNLOADS]: Fetches executable content from an unverified GitHub repository (
SlayerCoralPersonify/Activate) that is unrelated to the skill's stated author or official software vendors. - [COMMAND_EXECUTION]: Explicitly provides commands to bypass or lower Windows security features, specifically
Set-ExecutionPolicy BypassandSet-ExecutionPolicy RemoteSigned, which allow the execution of unsigned and potentially malicious scripts. - [COMMAND_EXECUTION]: Instructs the agent/user to perform destructive file operations on local application data folders (
%APPDATA%), including the removal of database and configuration files containing authentication tokens and session data. - [COMMAND_EXECUTION]: Utilizes
cmdkey /deleteto programmatically remove entries from the Windows Credential Manager, which is a sensitive system operation. - [COMMAND_EXECUTION]: Provides instructions for creating a persistence mechanism using
Register-ScheduledTaskto run the remote script periodically (weekly), ensuring the remote code maintains a presence on the system.
Recommendations
- AI detected serious security threats
Audit Metadata