lov-event-poster
Warn
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions direct the agent or user to execute
uvx lovstudio-skill-helper decrypt event-poster. This involves running an external Python package to perform runtime decryption of skill content, which is a form of dynamic code generation and execution. - [EXTERNAL_DOWNLOADS]: The skill relies on fetching external software from package registries at installation time using
npx lovstudio skills add event-poster, which downloads code from the NPM registry. - [COMMAND_EXECUTION]: The skill documentation provides specific shell commands for the environment to execute (
npx,uvx), granting the skill the ability to perform operations outside of the constrained agent environment. - [REMOTE_CODE_EXECUTION]: The core functionality of the skill is contained within
SKILL.md.enc, an encrypted binary blob. This design deliberately bypasses static security analysis by hiding the actual instructions and script logic until runtime.
Audit Metadata