devcontainers
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill guides the agent to clone an external repository (
https://github.com/bikramkgupta/do-app-devcontainer.git) and execute shell scripts from it, such as.devcontainer/tests/agent-test.shand.devcontainer/tests/run-all-tests.sh. Because this repository is hosted under a personal, unverified GitHub account that does not belong to the skill author (digitalocean-labs), executing these scripts represents a significant risk of arbitrary code execution. - [EXTERNAL_DOWNLOADS]: The skill pulls essential infrastructure configuration and test suites from an untrusted third-party repository at runtime instead of containing them within the skill package or hosting them on verified vendor infrastructure.
Recommendations
- AI detected serious security threats
Audit Metadata