forgejo
Fail
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the
orbitCLI tool using a shell-piped download:curl -sSfL https://raw.githubusercontent.com/jorgemuza/orbit/main/install.sh | sh. This pattern is used for initial setup and originates from the official repository of the skill's author ('jorgemuza'). - [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to download the
orbittool via Homebrew (brew install jorgemuza/tap/orbit) or directly from GitHub. These resources are hosted on infrastructure owned by the vendor. - [COMMAND_EXECUTION]: The skill's primary function is to execute local CLI commands (
orbit,fj) to interact with self-hosted git instances. It includes a passthroughapicommand that allows the agent to construct and execute arbitrary REST API calls against the configured Forgejo/Gitea host.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/jorgemuza/orbit/main/install.sh - DO NOT USE without thorough review
Audit Metadata