skills-manager
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npx skillsfor searching and adding extensions. It also references a specific environment variable$CHERRY_STUDIO_BUN_PATHfor alternative execution. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of the
skillspackage from the NPM registry during runtime via thenpxcommand. - [REMOTE_CODE_EXECUTION]: The skill facilitates the installation of third-party code from GitHub repositories (e.g.,
npx skills add <owner/repo>). It correctly identifies that these skills have full permissions and instructs the agent to provide source links, safety warnings, and require manual user confirmation before the installation proceeds.
Audit Metadata