kbo-results
Warn
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the 'kbo-game' package globally from the public NPM registry. This package is not from a verified or trusted organization, which introduces a supply chain risk if the package or registry entry were compromised.\n- [COMMAND_EXECUTION]: The skill executes shell commands to perform global system modifications via 'npm install -g' and runs Node.js scripts that load modules from computed file paths at runtime. The use of dynamic imports with paths constructed from environment variables can be risky as it allows for the execution of code from locations determined during execution.
Audit Metadata