lov-oh-my-landingpage
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: HIGHOBFUSCATIONREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [OBFUSCATION]: The skill's core functionality, including instructions, scripts, and reference documents, is stored in encrypted files (.enc) using AES-256-GCM, as indicated by the MANIFEST.enc.json file. This obfuscation prevents any static analysis or security auditing of the skill's actual behavior.
- [REMOTE_CODE_EXECUTION]: The SKILL.md file instructs the user or agent to execute remote code from package registries using npx (for the 'lovstudio' package) and uvx (for the 'lovstudio-skill-helper' package). This pattern downloads and executes code from external sources at runtime.
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands to install and decrypt its components, allowing external vendor-provided scripts to control the skill's deployment and execution.
- [DYNAMIC_EXECUTION]: The skill uses a decryption process to load its instructions at runtime, which constitutes dynamic code loading from an opaque encrypted source, bypassing platform-level safety checks.
Recommendations
- AI detected serious security threats
Audit Metadata