edgespeak-align
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a command to download and execute an installation script from
https://edgespeak.com/install.sh. While this pattern (piping a remote script to a shell) is often a security risk, here it is the documented installation method for the primary tool the skill is designed to use ('EdgeSpeak'). The domainedgespeak.commatches the vendor's identity. - [COMMAND_EXECUTION]: The skill frequently uses
edgespeak-clito perform its core functions, such as checking status (edgespeak-cli status), managing licenses (edgespeak-cli login,edgespeak-cli activate), and performing the actual alignment (edgespeak-cli align). these are legitimate uses of the intended tool. - [REMOTE_CODE_EXECUTION]: As noted in the automated scan, the skill includes the command
curl -fsSL https://edgespeak.com/install.sh | sh. This is a remote code execution pattern; however, in the context of this skill, it is providing a standard installation path for the vendor's own software from their official domain.
Audit Metadata