cc-plugins
Fail
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides commands designed to download and execute scripts from the internet by piping curl output directly into the bash shell. This allows for the execution of arbitrary remote code within the user's environment.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to programmatically inspect the local filesystem, specifically scanning directories in the user's home directory (~/.claude/) to identify installed plugins and configuration files.
- [EXTERNAL_DOWNLOADS]: The skill fetches installation scripts from external GitHub repositories, including resources from the well-known anthropics organization and the author's personal repository.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/KevinZai/cc-commander/main/install-remote.sh - DO NOT USE without thorough review
- INFO: Downloads code from trusted source(s): https://raw.githubusercontent.com/anthropics/everything-claude-code/main/install.sh
Audit Metadata