skills/cskwork/skills/impeccable/Gen Agent Trust Hub

impeccable

Fail

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The launcher scripts scripts/impeccable and scripts/impeccable.cmd are designed to download platform-specific binaries from a GitHub repository (https://github.com/pbakaus/impeccable/releases). While the script includes SHA-256 checksum verification, the download source is a personal repository that is not included in the trusted vendor lists.
  • [REMOTE_CODE_EXECUTION]: The skill's primary logic resides in an external binary that is downloaded and executed at runtime. This creates a vector for remote code execution by allowing the external repository to provide executable content that the agent runs to perform design and auditing tasks.
  • [COMMAND_EXECUTION]: The skill instructions in SKILL.md and several reference files (e.g., reference/init.md, reference/document.md, reference/critique.md) direct the AI agent to execute shell commands via the impeccable script. This workflow is essential for the skill but is intrinsically tied to the execution of the externally sourced binary.
  • [PRIVILEGE_ESCALATION]: The scripts/impeccable script applies execution permissions (chmod +x) to the dynamically downloaded binary files before execution, which is a high-risk operation when applied to untrusted content.
  • [PERSISTENCE]: The skill manages "design detector hooks" (as described in reference/hooks.md) that modify the AI agent's project-specific configuration files (e.g., .claude/settings.local.json, .cursor/hooks.json, and .github/hooks/impeccable.json). These hooks ensure that the skill's code is automatically executed upon every file edit, establishing persistence within the project's development environment.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 11, 2026, 12:15 AM