request-review
Fail
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external command-line tools such as Claude Code and Cursor with high-risk flags designed to bypass safety protocols. Specifically, it uses
--dangerously-skip-permissionsfor Claude and--yolofor Cursor, both of which suppress user confirmation prompts and security warnings, allowing potentially destructive actions to occur without human oversight. - [COMMAND_EXECUTION]: The instructions direct the agent to search through user terminal configuration files (such as shell profiles or alias settings) to find command aliases if a tool name is not recognized. This process involves parsing and executing commands derived from local configuration files, which can lead to arbitrary command execution if those configurations contain untrusted or maliciously crafted content.
- [CREDENTIALS_UNSAFE]: By requiring the agent to read and parse user terminal configuration files to find aliases, the skill risks exposing sensitive information. Shell profiles and configuration files frequently contain hardcoded environment variables, API keys, and authentication tokens that should not be accessed by the agent during normal operation.
Recommendations
- AI detected serious security threats
Audit Metadata