ai-second-brain
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an instruction file ('CLAUDE.md') from Andrej Karpathy's official GitHub Gist. This is a well-known source and is central to the skill's stated purpose of implementing the Karpathy Wiki framework.
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to download a remote markdown file via 'curl' and save it locally. While the scanner flagged this as remote code execution, in the context of this skill, it is fetching a configuration/instruction file from a reputable developer (Karpathy) rather than executable binary code.
- [COMMAND_EXECUTION]: The skill uses various shell commands ('mkdir', 'ls', 'mv', 'cd') to manage local directories and files within the user's '~/Desktop/Brain' folder. These are standard administrative actions for setting up the requested environment.
- [DYNAMIC_EXECUTION]: The 'render-social-preview.js' script uses Puppeteer to render a local HTML file ('social-preview.html') into an image. It relies on a local installation of Puppeteer and is used for generating social media previews of the vault, which is a benign utility function.
Audit Metadata