god-ship
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to run
npx -y godpowers@7 gate shipandnpx -y godpowers@7 record ship. The-yflag (shorthand for--yes) causes thenpxtool to automatically download and execute thegodpowerspackage from the public npm registry if it is not already installed, bypassing the standard interactive prompt that asks the user for permission to install the package. - [COMMAND_EXECUTION]: The skill relies on the execution of an external CLI tool (
godpowers) to manage the release process. Running code from an unverified third-party package directly in the shell provides that package with the same privileges as the agent, which could be exploited if the package is malicious or its registry entry is compromised.
Audit Metadata