Skills
Navigate
skills/gethamster/plugin/setup/Gen Agent Trust Hub

setup

Fail

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script from an unverified remote source using a pipe to bash. Evidence: curl -fsSL https://tryhamster.com/cli/install | bash in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill references external URLs for retrieving the CLI tool and MCP configuration that are not found in the verified vendor list for this author. Evidence: https://tryhamster.com/cli/install and https://tryhamster.com/mcp.
  • [COMMAND_EXECUTION]: The skill executes multiple local commands and scripts to manage the installation lifecycle. Evidence: scripts/ensure-ready.sh, scripts/ensure-ready.ps1, hamster auth login, hamster init, and hamster sync.
  • [PRIVILEGE_ESCALATION]: The instructions direct the agent to attempt command execution with elevated permissions to bypass operating system security boundaries. Evidence: Instructions in SKILL.md to re-run readiness checks with elevated permission on macOS to read Keychain data.
Recommendations
  • HIGH: Downloads and executes remote code from: https://tryhamster.com/cli/install - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 29, 2026, 02:39 PM