discover-israel-skills
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads third-party content from various GitHub repositories listed in
data/third-party-skills.yaml. This includes repositories from the 'skills-il' organization and several individual community contributors (e.g., alexpolonsky, lirantal, WolfikOz). - [COMMAND_EXECUTION]: The skill uses shell commands to automate the installation process. Specifically, it uses
git clone(with--depth 1and--sparseoptions) to fetch repositories andmv/rmto organize the files into the~/.claude/skills/directory. It also executestest -dto check for existing installations. - [COMMAND_EXECUTION]: The procedure includes a dynamic checkout mechanism for monorepos, where it creates a temporary directory using
mktemp -d, performs a sparse checkout of a specific subpath, and then cleans up. This is a standard developer workflow for installing subcomponents of a larger repository. - [REMOTE_CODE_EXECUTION]: While the skill downloads code that will later be executed by the agent, it explicitly includes safeguards: it requires manual confirmation for every installation, encourages users to audit the source URL provided, and explicitly refuses to run automated post-install scripts or
npm installcommands, leaving those to the user's discretion.
Audit Metadata