Skills
Navigate
skills/luci-efe/skills/proof/Gen Agent Trust Hub

proof

Warn

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPERSISTENCEDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's core logic in scripts/_lib/proof.mjs and scripts/_lib/execute.mjs executes arbitrary shell commands defined in a JSON manifest file (checks.json) using child_process.spawn with direct argument passing.
  • [PERSISTENCE]: The scripts/_lib/doctor.mjs script facilitates persistence by modifying the agent's local configuration file (.claude/settings.local.json) to install hooks for UserPromptSubmit, SessionStart, and Stop events, which automatically trigger the skill's adapter scripts during the agent's lifecycle.
  • [DYNAMIC_EXECUTION]: The scripts/_lib/hook-adapter.mjs script dynamically discovers and executes external scripts (specifically a relay.mjs script from other skills) based on runtime skill discovery and metadata analysis.
  • [PRIVILEGE_ESCALATION]: The scripts/_lib/providers.json file contains installation instructions for various tools that suggest the use of sudo for system-level package management on Linux platforms.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 16, 2026, 01:39 PM