cafe3310-skill-installer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and the installation script clone the author's public repository from
https://github.com/cafe3310/public-agent-skills.gitto a temporary directory on the local system. - [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of a bash script (
install.sh) retrieved from the cloned repository. This behavior is central to the skill's stated purpose of automating setup and updates from the developer's own source code. - [COMMAND_EXECUTION]: The installation process involves standard shell operations including
git clone,chmodfor permissions, andcpfor file deployment. It also scans directory contents to identify and update existing skills. - [DATA_EXPOSURE]: The script accesses agent-specific configuration directories (
~/.agents,~/.claude,~/.gemini) to locate existing skills and manage updates. This file system access is scoped specifically to directories intended for storing agent extensions.
Audit Metadata