understand-setup

Fail

Audited by Gen Agent Trust Hub on Apr 18, 2026

Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple shell commands to perform analysis and launch a dashboard.
  • python3 -m jarvis_understand ~/.claude --mode claude executes a Python module against the sensitive Claude configuration directory.
  • npx vite --open launches a local development server and opens it in a browser.
  • [DATA_EXFILTRATION]: The skill exposes the sensitive ~/.claude directory to a local web server.
  • The command GRAPH_DIR=~/.claude npx vite --open instructs the agent to serve files from the Claude configuration directory via Vite. This directory often contains sensitive information, including session data, internal tool logic, and configuration files. Serving this data via a web server creates a significant risk of data exposure to other processes or users on the local network.
  • [EXTERNAL_DOWNLOADS]: The skill relies on unverified external components and a specific local project structure.
  • It depends on a Python module named jarvis_understand which is not a standard library and whose source is unverified.
  • It requires a pre-existing project located at ~/Projects/understand-anything/understand-anything-plugin/packages/dashboard, implying the user must have cloned unverified code from an external repository.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 18, 2026, 12:07 PM
Security Audit — agent-trust-hub — understand-setup