agent-starter-kit
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary functionality is delivered through a bash script (
install.sh) that executes multiple system commands, includingnpxand theclaudeCLI, to modify the agent's environment. - [EXTERNAL_DOWNLOADS]: The installer script fetches and installs external components from multiple GitHub repositories. While some sources are from the vendor or established organizations like Vercel, others are from unverified third-party GitHub accounts.
- Fetches configuration and skills from Vercel Labs' repositories.
- Downloads a design-related skill from the vendor's GitHub repository.
- Installs additional skills and plugins from individual GitHub users (
forrestchang,nextlevelbuilder,juliusbrussee, andobra). - [REMOTE_CODE_EXECUTION]: The skill uses
npx -y skills addandclaude plugin installto automatically download and integrate remote code into the agent's execution path. The use of the-yflag innpxbypasses user confirmation for the installation of the skills-management tool itself, and the script proceeds to install remote skills and plugins without version pinning or integrity verification.
Audit Metadata