setup-all
Warn
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/setup_all.pyscript makes extensive use ofsubprocess.runwithshell=Trueto perform system-level operations, including environment checks and package installations. - [REMOTE_CODE_EXECUTION]: The skill facilitates the automated download and installation of code from external sources using the
npx skills addcommand. - [EXTERNAL_DOWNLOADS]: The skill fetches multiple dependencies from GitHub repositories, specifically from the
horizon-continentalorganization. - [COMMAND_EXECUTION]: The script automatically triggers the execution of newly installed skills using the
claudeCLI, granting them a broad set of permissions includingBash(run scripts and commands),Read,Write, andEdit. - [DATA_EXPOSURE]: The manifest includes several skills (e.g.,
web-search-mcp,remove-feishu-mcp) designed to programmatically access and modify sensitive local data, such as~/.claude.jsonand API credentials.
Audit Metadata