ephemeral-ci-environment

Fail

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION

Full Analysis

[REMOTE_CODE_EXECUTION]: The skill includes a command curl -fsSL https://box.ascii.dev/install | sh which downloads and immediately executes a shell script from an external, untrusted domain. This provides the remote server with full control over the execution environment.
[COMMAND_EXECUTION]: The skill relies on executing shell commands through the box CLI tool to interact with infrastructure, which is predicated on the initial untrusted installation.

Recommendations

HIGH: Downloads and executes remote code from: https://box.ascii.dev/install - DO NOT USE without thorough review
AI detected serious security threats

Audit Metadata

Risk Level

CRITICAL

Analyzed

Jun 13, 2026, 05:29 AM