skills/lovstudio/skills/lov-proposal/Gen Agent Trust Hub

lov-proposal

Warn

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run commands that download and execute code from an external source using npx lovstudio skills add proposal and uvx lovstudio-skill-helper decrypt proposal. These tools originate from the skill author's infrastructure but are not part of a globally trusted registry.
  • [OBFUSCATION]: The core logic and instructions of the skill are stored in an encrypted file SKILL.md.enc using the AES-256-GCM cipher. This prevents the analysis of the actual instructions the agent will follow at runtime, posing a risk as the decrypted behavior cannot be verified beforehand.
  • [COMMAND_EXECUTION]: The installation and initialization process relies on direct shell command execution to manage the lifecycle of the skill, including decryption and credential management.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 24, 2026, 12:55 AM
Security Audit — agent-trust-hub — lov-proposal