voice-ai
Fail
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The instruction file contains a command
npx github:vibeforge1111/vibeship-spawner-skills install. This pattern downloads and immediately executes code from a remote, unvetted GitHub repository. This execution occurs with the user's current shell permissions and can be used to run arbitrary malicious scripts. - [EXTERNAL_DOWNLOADS]: The skill references and encourages the installation of software from an external third-party repository (
vibeforge1111/vibeship-spawner-skills). This presents a supply chain security risk as the remote code could be modified to include malicious behavior without verification or pinning to a specific version.
Recommendations
- AI detected serious security threats
Audit Metadata