cloud-vm
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute a script directly from a remote URL by piping the output of
curlinto a shell environment. - Evidence:
curl -fsSL https://box.ascii.dev/install | shin SKILL.md. - [EXTERNAL_DOWNLOADS]: Fetches a setup script from an external, unverified source (
https://box.ascii.dev/install) that is not part of a trusted organization or well-known service registry. - [COMMAND_EXECUTION]: Invokes several shell commands using a third-party CLI tool (
box) to provision, manage, and SSH into remote virtual machines. - Evidence: usage of
box new,box ssh,box info,box stop, andbox resumein the Recipe section of SKILL.md.
Recommendations
- HIGH: Downloads and executes remote code from: https://box.ascii.dev/install - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata