lovstudio-event-poster
Warn
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill hides its actual operational instructions within an encrypted binary file (
SKILL.md.enc) and requires the agent to execute a vendor-provided tool (uvx lovstudio-skill-helper) to decrypt them during each use. This dynamic loading of hidden logic bypasses static analysis and allows for runtime instruction modification. - [COMMAND_EXECUTION]: The skill directs the agent to execute multiple shell commands, including
uvxandnpxwrappers, to perform decryption, license activation, and installation of skill components. - [EXTERNAL_DOWNLOADS]: The skill explicitly mentions that the decryption process requires a network request (an HTTP round-trip) to verify licenses and fetch content through the
lovstudio-skill-helpertool, introducing external dependencies into the agent's core instruction loop.
Audit Metadata