agent-forge
Warn
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery and installation of community-provided skills by executing 'npx skills find' and 'npx skills add <repository_url>'. This mechanism allows for the integration of third-party code from arbitrary remote sources into the local environment.
- [REMOTE_CODE_EXECUTION]: By recommending and potentially executing the installation of skills from remote GitHub repositories or ZIP archives, the skill enables the execution of external code. This includes vendor-provided resources from 'github.com/lensetek/*' and potentially other user-provided URLs.
- [COMMAND_EXECUTION]: The skill performs automated file system operations, including initializing directory structures and writing 'SKILL.md' and other configuration files (like 'task.md', 'handoff.md', and 'AGENTS.md') to the '.agents/' and 'output/' directories.
- [DATA_EXFILTRATION]: The skill is designed to read the local '.agents/user-profile.json' file to retrieve sensitive user information such as technical preferences, constraints, and standard configurations to inform the agent architectural process.
Audit Metadata