Skills
Navigate
skills/djalmajr/skills/wiki-init/Gen Agent Trust Hub

wiki-init

Fail

Audited by Gen Agent Trust Hub on May 19, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The primary script scripts/wiki-init.ts clones an external repository (https://github.com/tobi/qmd.git) and proceeds to execute bun install and bun run build. This allows for arbitrary code execution on the host machine through the build scripts and dependencies of an unverified third-party repository.
  • [COMMAND_EXECUTION]: The skill installs persistent shell hooks in the .claude/hooks/, .codex/hooks/, and .opencode/hooks/ directories. These hooks are configured to run automatically upon session start and after specific tool executions (e.g., file edits), allowing for the persistent execution of custom scripts.
  • [EXTERNAL_DOWNLOADS]: The skill performs an unverified download of source code from an external GitHub repository during the initialization and installation process.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
May 19, 2026, 11:46 AM
Security Audit — agent-trust-hub — wiki-init