agent-development
Fail
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation encourages users to clone the
msitarzewski/agency-agentsrepository from GitHub. This repository is not associated with a recognized trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: The skill instructs users to "Run the setup command from the repo README" after cloning the repository to install agents to
~/.claude/agents/. This pattern of executing unvetted scripts from a third-party repository is a high-risk behavior as the instructions in the external README could lead to the execution of malicious code on the host system. - [COMMAND_EXECUTION]: The skill references several local shell scripts (
scripts/validate-agent.shandscripts/test-agent-trigger.sh) and promotes the use of tools likeBashandWritefor agent operations, expanding the potential attack surface.
Recommendations
- AI detected serious security threats
Audit Metadata