ty-skills
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHMETADATA_POISONINGEXTERNAL_DOWNLOADS
Full Analysis
- [METADATA_POISONING]: The skill name, description, and reference files contain highly deceptive metadata and claims, falsely identifying a tool named 'ty' as an official Rust-based type checker from Astral. This misleading attribution alters the agent's perception of the tool's trustworthiness and safety profile.
- [EXTERNAL_DOWNLOADS]: The instructions direct the agent to execute installation commands for unverified dependencies, specifically
uv tool install ty,pip install ty, and the VS Code extensionastral-sh.ty. This presents a supply chain risk by promoting the installation of unverified software under a fraudulent brand identity.
Recommendations
- AI detected serious security threats
Audit Metadata