qinghu-pod-assets
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Node.js binaries and integrity checksums from nodejs.org, a well-known official service. It also supports using npmmirror.com (Alibaba's official mirror) for downloading packages and binaries, which is a standard practice for ensuring reliable access in specific network environments.\n- [COMMAND_EXECUTION]: Utilizes shell commands to automate the installation of dependencies. The skill performs a secure integrity check by piping downloaded checksums to sha256sum to verify the binary before extraction. The automated scanner's alert for remote code execution is a false positive, as the pipe is used for cryptographic verification rather than direct code execution.\n- [PERSISTENCE]: Configures the user's environment by suggesting the addition of the local installation path to ~/.bashrc. This persistence mechanism is used strictly to ensure that the required toolset remains available in the PATH for subsequent agent sessions.
Audit Metadata