understand-setup
Fail
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands to perform analysis and launch a dashboard.
python3 -m jarvis_understand ~/.claude --mode claudeexecutes a Python module against the sensitive Claude configuration directory.npx vite --openlaunches a local development server and opens it in a browser.- [DATA_EXFILTRATION]: The skill exposes the sensitive
~/.claudedirectory to a local web server. - The command
GRAPH_DIR=~/.claude npx vite --openinstructs the agent to serve files from the Claude configuration directory via Vite. This directory often contains sensitive information, including session data, internal tool logic, and configuration files. Serving this data via a web server creates a significant risk of data exposure to other processes or users on the local network. - [EXTERNAL_DOWNLOADS]: The skill relies on unverified external components and a specific local project structure.
- It depends on a Python module named
jarvis_understandwhich is not a standard library and whose source is unverified. - It requires a pre-existing project located at
~/Projects/understand-anything/understand-anything-plugin/packages/dashboard, implying the user must have cloned unverified code from an external repository.
Recommendations
- AI detected serious security threats
Audit Metadata