Skills
Navigate
skills/jasperpwang/lab-codex-skills/paper-spine-update/Gen Agent Trust Hub

paper-spine-update

Fail

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/paperspine_update.py downloads a ZIP archive from https://github.com/WUBING2023/PaperSpine/archive/refs/heads/main.zip and installs its contents by replacing local skill directories in ~/.claude/skills, ~/.codex/skills, and ~/.openclaw/skills. This allows arbitrary code from the remote repository to be executed in future sessions.\n- [EXTERNAL_DOWNLOADS]: The skill fetches version metadata from https://raw.githubusercontent.com/WUBING2023/PaperSpine/main/dist/paperspine_version.json and the full suite archive from GitHub at runtime.\n- [COMMAND_EXECUTION]: SKILL.md instructs the agent to run the Python updater script using shell commands like python3 ~/.claude/skills/paper-spine-update/scripts/paperspine_update.py --yes.\n- [PRIVILEGE_ESCALATION]: The updater script modifies the agent platform's internal configuration file (~/.claude/settings.json) to remove skillOverrides. It also gains the ability to modify the logic of other skills by overwriting their files in the skills directory.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 30, 2026, 02:29 AM