lov-xhs
Warn
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: MEDIUMOBFUSCATIONREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [OBFUSCATION]: The skill's core instructions and all supporting scripts are stored in an encrypted format (AES-256-GCM), making it impossible to perform a static security analysis of the intended behavior. The provided SKILL.md is merely a wrapper that directs the agent to a decryption routine.
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to use package runners like uvx and npx to download and execute code from remote sources (lovstudio-skill-helper, lovstudio, skills).
- [DYNAMIC_EXECUTION]: The agent is commanded to decrypt instructions at runtime and follow it to the letter, which allows the skill to dynamically alter its behavior and instructions in a way that is opaque to safety filters.
- [CREDENTIALS_UNSAFE]: The skill prompts the user to input a license key via the command line (npx lovstudio license ). While this may be a legitimate license check, handling sensitive identifiers in this manner is a risk factor for potential credential harvesting.
Audit Metadata