configure-ecc
Fail
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill executes a
git clonecommand to fetch content fromhttps://github.com/affaan-m/everything-claude-code.git. Because this source is an unverified third-party account, the safety and integrity of the downloaded skills and rules cannot be established. - [COMMAND_EXECUTION]: The installation process relies on the execution of multiple shell commands, including
rm -rf,git clone,mkdir -p,cp -r, andgrep. These commands are used to modify the local filesystem, specifically targeting the agent's configuration paths in~/.claude/. - [REMOTE_CODE_EXECUTION]: Content downloaded from the external repository is moved into the
~/.claude/skills/and~/.claude/rules/directories. This allows externally provided instructions and logic to be loaded into the agent's active environment, effectively granting the remote repository control over the agent's future behavior and capabilities. - [DYNAMIC_EXECUTION]: The skill includes an 'optimization' phase that reads and modifies the newly installed skill files in-place. This involves the agent processing and editing potentially untrusted markdown and code files, creating a vulnerability surface for instruction injection during the modification process.
Recommendations
- AI detected serious security threats
Audit Metadata