ty-skills

Fail

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: HIGHMETADATA_POISONINGEXTERNAL_DOWNLOADS
Full Analysis
  • [METADATA_POISONING]: The skill name, description, and reference files contain highly deceptive metadata and claims, falsely identifying a tool named 'ty' as an official Rust-based type checker from Astral. This misleading attribution alters the agent's perception of the tool's trustworthiness and safety profile.
  • [EXTERNAL_DOWNLOADS]: The instructions direct the agent to execute installation commands for unverified dependencies, specifically uv tool install ty, pip install ty, and the VS Code extension astral-sh.ty. This presents a supply chain risk by promoting the installation of unverified software under a fraudulent brand identity.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 14, 2026, 08:39 PM