skills/hannsxpeter/godpowers/god-ship/Gen Agent Trust Hub

god-ship

Warn

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to run npx -y godpowers@7 gate ship and npx -y godpowers@7 record ship. The -y flag (shorthand for --yes) causes the npx tool to automatically download and execute the godpowers package from the public npm registry if it is not already installed, bypassing the standard interactive prompt that asks the user for permission to install the package.
  • [COMMAND_EXECUTION]: The skill relies on the execution of an external CLI tool (godpowers) to manage the release process. Running code from an unverified third-party package directly in the shell provides that package with the same privileges as the agent, which could be exploited if the package is malicious or its registry entry is compromised.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 1, 2026, 10:40 PM