configure-ecc

Fail

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill executes a git clone operation from https://github.com/affaan-m/everything-claude-code.git. The repository belongs to an unverified third-party account that is not recognized as a trusted source.
  • [REMOTE_CODE_EXECUTION]: The skill copies the contents of the unverified remote repository directly into the agent's core instruction paths (~/.claude/skills/ and ~/.claude/rules/). Because these skills and rules contain the primary logic and constraints for the agent, this process constitutes a remote instruction injection vector where an external party can provide the agent's execution logic.
  • [COMMAND_EXECUTION]: The skill uses multiple shell commands including rm, git clone, mkdir, and cp to manage files within the agent's sensitive configuration environment. It also proposes to perform in-place editing of these instructional files during an 'optimization' phase, which can lead to the modification of active instructions.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 4, 2026, 07:07 PM