install-recommended-skills
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is specifically designed to fetch and install external content from a third-party GitHub repository using the
gh skill installcommand. - Evidence: Commands in
SKILL.mdsuch asgh skill install mattpocock/skills engineering/improve-codebase-architectureautomate the retrieval of remote resources. - [REMOTE_CODE_EXECUTION]: By installing external skills, the agent's capabilities are extended with unvetted logic from a remote source. Since these skills can contain instructions that interact with the file system or run commands, this represents a potential risk of executing untrusted logic.
- Evidence: The batch installation of six distinct remote skills (
improve-codebase-architecture,tdd,to-issues,to-prd,codebase-design,grill-with-docs) grants those remote packages influence over the agent's future behavior without individual review.
Audit Metadata