breathe-cli-resonance-breathing
Warn
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download a script (
breathe.py) from an external GitHub repository (github.com/marekkowalczyk/breathe-cli). This repository does not belong to the skill's authoring organization or a verified well-known service, posing a potential supply chain risk if the external content is modified. - [REMOTE_CODE_EXECUTION]: The installation section provides a shell command sequence (
curl -O ... && chmod +x ... && ./breathe.py) that performs a direct download and execution of external code without verification of the file's integrity (e.g., via checksum or GPG signature). - [COMMAND_EXECUTION]: The integration examples include Python code that uses the
subprocess.runfunction to execute the CLI tool on the local system. This pattern demonstrates the capability to invoke shell processes from within the skill's environment.
Audit Metadata