lov-proposal
Warn
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run commands that download and execute code from an external source using
npx lovstudio skills add proposalanduvx lovstudio-skill-helper decrypt proposal. These tools originate from the skill author's infrastructure but are not part of a globally trusted registry. - [OBFUSCATION]: The core logic and instructions of the skill are stored in an encrypted file
SKILL.md.encusing the AES-256-GCM cipher. This prevents the analysis of the actual instructions the agent will follow at runtime, posing a risk as the decrypted behavior cannot be verified beforehand. - [COMMAND_EXECUTION]: The installation and initialization process relies on direct shell command execution to manage the lifecycle of the skill, including decryption and credential management.
Audit Metadata