skill-installer

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses execSync in scripts/lib/exec.js to execute system commands necessary for tool installation, version checks, and environment setup.- [EXTERNAL_DOWNLOADS]: The installer fetches resources from official and project-related sources, including GitHub repositories (microsoft/playwright-cli, github/awesome-copilot, obra/superpowers) and official package registries.- [REMOTE_CODE_EXECUTION]: The installation process involves downloading and executing code from external sources. For example, it fetches the Azure CLI installer from Microsoft's official servers via a piped bash script and builds cloned projects using npm install and npm run build.- [PROMPT_INJECTION]: The skill includes functionality to modify the agent's configuration files, such as CODEARTS.md or dedicated bootstrap rule files, to integrate the capabilities of the installed tools into the agent's persistent instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 05:53 PM
Security Audit — agent-trust-hub — skill-installer