find-qualified-titles
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the "deepline" package using a custom registry ("https://code.deepline.com/api/v2/npm/"). This bypasses the default public NPM registry, which is a common security best practice for ensuring package integrity.
- [COMMAND_EXECUTION]: The skill directs the agent to perform several shell commands, including global package installation ("npm install -g"), path configuration, and interaction with the "deepline" CLI for authentication ("deepline auth register") and status checks.
- [REMOTE_CODE_EXECUTION]: The combination of installing a third-party package from a custom remote source and subsequently executing its CLI tool constitutes the execution of unverified remote code on the host system.
Audit Metadata