configure-ecc
Fail
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes a
git cloneoperation fromhttps://github.com/affaan-m/everything-claude-code.git. The repository belongs to an unverified third-party account that is not recognized as a trusted source. - [REMOTE_CODE_EXECUTION]: The skill copies the contents of the unverified remote repository directly into the agent's core instruction paths (
~/.claude/skills/and~/.claude/rules/). Because these skills and rules contain the primary logic and constraints for the agent, this process constitutes a remote instruction injection vector where an external party can provide the agent's execution logic. - [COMMAND_EXECUTION]: The skill uses multiple shell commands including
rm,git clone,mkdir, andcpto manage files within the agent's sensitive configuration environment. It also proposes to perform in-place editing of these instructional files during an 'optimization' phase, which can lead to the modification of active instructions.
Recommendations
- AI detected serious security threats
Audit Metadata