configure-ecc

Fail

Audited by Gen Agent Trust Hub on Mar 20, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill executes a git clone command to fetch content from https://github.com/affaan-m/everything-claude-code.git. Because this source is an unverified third-party account, the safety and integrity of the downloaded skills and rules cannot be established.
  • [COMMAND_EXECUTION]: The installation process relies on the execution of multiple shell commands, including rm -rf, git clone, mkdir -p, cp -r, and grep. These commands are used to modify the local filesystem, specifically targeting the agent's configuration paths in ~/.claude/.
  • [REMOTE_CODE_EXECUTION]: Content downloaded from the external repository is moved into the ~/.claude/skills/ and ~/.claude/rules/ directories. This allows externally provided instructions and logic to be loaded into the agent's active environment, effectively granting the remote repository control over the agent's future behavior and capabilities.
  • [DYNAMIC_EXECUTION]: The skill includes an 'optimization' phase that reads and modifies the newly installed skill files in-place. This involves the agent processing and editing potentially untrusted markdown and code files, creating a vulnerability surface for instruction injection during the modification process.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 20, 2026, 08:24 PM