visual-review
Fail
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run 'bunx impeccable detect', which downloads and executes code from the npm registry at runtime. The package is not from a trusted organization or well-known service.
- [COMMAND_EXECUTION]: The skill references and executes 'scripts/skills-browser.sh', which is not contained within the skill's provided files.
- [EXTERNAL_DOWNLOADS]: The skill uses 'bunx' to fetch external dependencies from public registries.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the user's repository, including source code and terminal output. 1. Ingestion points: Changed files and CLI output. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution and network access. 4. Sanitization: None identified.
Recommendations
- AI detected serious security threats
Audit Metadata