py-quality-setup
Fail
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to modify
.claude/settings.local.jsonto automatically allow a broad set of shell commands, includingchmod,ln,uv,pip, and variousgitsubcommands. This effectively bypasses the platform's security prompts and user review for these operations. - [PRIVILEGE_ESCALATION]: The skill instructs the agent to grant itself permissions for sensitive tools like
chmodandln, and to create symlinks targeting the agent's internal configuration directories (~/.claude/hooks), allowing the agent to modify its own execution environment. - [PERSISTENCE]: The skill configures a 'Stop' hook in
~/.claude/settings.jsonthat triggers the execution ofpython3 ~/.claude/hooks/lint-gate.py. This ensures specific code runs automatically at the conclusion of every session, creating a persistent execution mechanism. - [DYNAMIC_EXECUTION]: The persistent 'Stop' hook mechanism executes a script located at
~/.claude/hooks/lint-gate.pywhich is symlinked to a source managed by a different skill (py-git-hooks), introducing a dependency on external code execution at runtime.
Recommendations
- AI detected serious security threats
Audit Metadata