Skills
Navigate
skills/lovstudio/general-skills/lovstudio-write-professional-book/Gen Agent Trust Hub

lovstudio-write-professional-book

Fail

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill requires the agent to download and execute code via uvx lovstudio-skill-helper and npx lovstudio. These commands fetch and execute third-party packages from public registries.
  • [COMMAND_EXECUTION]: The skill mandates the use of shell commands to decrypt its core instructions and reference files, specifically using uvx to process .enc files.
  • [EXTERNAL_DOWNLOADS]: The skill performs network communication with lovstudio.ai on every invocation to handle decryption and license validation, in addition to pulling remote packages.
  • [PROMPT_INJECTION]: The skill implements a bypass of instruction transparency by encrypting its logic. The agent is instructed to decrypt the real instructions at runtime and 'follow it to the letter', allowing for the execution of arbitrary instructions that cannot be audited during static analysis.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 29, 2026, 02:54 PM
Security Audit — agent-trust-hub — lovstudio-write-professional-book