zero
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill executes a script from https://zerolang.ai/install.sh by piping it directly into bash. This pattern allows an external server to execute arbitrary commands on the system without user verification.\n- [EXTERNAL_DOWNLOADS]: The skill downloads and installs software from the external domain https://zerolang.ai.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple system commands, including modifying the environment PATH and interacting with the zero CLI tool to perform operations on the host file system.\n- [REMOTE_CODE_EXECUTION]: The instructions direct the agent to dynamically load additional skill content via the zero skills get command, which allows the installed binary to provide the agent with new instructions at runtime that were not present in the original skill metadata.
Recommendations
- HIGH: Downloads and executes remote code from: https://zerolang.ai/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata