lov-academic-translator
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: CRITICALOBFUSCATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The skill uses AES-256-GCM encryption for all functional components, including SKILL.md.enc, translate_paper_pdf.py.enc, and openai.yaml.enc. This deliberate concealment prevents any inspection of the skill's actual logic, safety, or intent.
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute external tools via 'npx lovstudio' and 'uvx lovstudio-skill-helper'. These tools download and execute code from public registries (NPM and PyPI) without version pinning or integrity checks, posing a high risk of remote code execution.
- [COMMAND_EXECUTION]: The skill requires the manual execution of shell commands to function. This bypasses the typical isolated execution environment of AI agents and introduces unvetted code into the local environment.
- [DYNAMIC_EXECUTION]: The skill's architecture relies on runtime decryption performed by an external 'helper' tool. This allows the skill to load and execute code that was not visible during installation or analysis, making it impossible to verify the final payload.
Recommendations
- AI detected serious security threats
Audit Metadata