run-untrusted-code
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's installation instructions utilize the high-risk
curl | shpattern to download and execute a script fromhttps://box.ascii.dev/install. This method provides no way to verify the script's integrity before execution, granting the remote source the ability to run arbitrary commands on the user's system.\n- [EXTERNAL_DOWNLOADS]: The skill downloads and executes binaries from an untrusted external domain (box.ascii.dev) that is not part of the verified trusted vendors list, creating a potential supply chain vulnerability.
Recommendations
- HIGH: Downloads and executes remote code from: https://box.ascii.dev/install - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata