skills/k5-mot/skills/ts-dev/Gen Agent Trust Hub

ts-dev

Fail

Audited by Gen Agent Trust Hub on Aug 12, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the execution of a remote script using a piped command curl -fsSL https://vite.plus | bash in references/setup.md. This method downloads and executes code directly from an external domain in the local shell environment, which is a high-risk pattern for arbitrary code execution.
  • [EXTERNAL_DOWNLOADS]: The skill requires the global installation of packages vite-plus and @voidzero-dev/vite-plus-core from sources that are not part of the established trusted vendor list. Additionally, it specifies dependencies on project-specific scoped packages @serendie/design-token, @serendie/symbols, and @serendie/ui without a verified or standard public registry origin.
  • [COMMAND_EXECUTION]: The skill provides multiple commands for system-level configuration and dependency management, including pnpm exec playwright install --with-deps which downloads and installs external browser binaries and system libraries at runtime, and pre-commit install which modifies local git hooks.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 12, 2026, 04:49 PM
Security Audit — agent-trust-hub — ts-dev