local-action-verification

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/install-act.sh downloads executable content from https://raw.githubusercontent.com/nektos/act/master/install.sh and pipes it directly into the bash shell for execution.- [PRIVILEGE_ESCALATION]: The installation script scripts/install-act.sh attempts to execute the downloaded script with sudo privileges if available, allowing for system-wide binary installation and potentially broader system modifications.- [EXTERNAL_DOWNLOADS]: The skill downloads the act utility from a remote GitHub repository during the setup process.- [COMMAND_EXECUTION]: The script scripts/run-act.sh invokes the act binary with arguments provided via the first command-line parameter, enabling the execution of arbitrary act commands.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/nektos/act/master/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 14, 2026, 04:26 PM
Security Audit — agent-trust-hub — local-action-verification