k-skill-setup
Warn
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPERSISTENCECOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@nomadamas/k-skillpackage and clones other skill components from theNomaDamasGitHub organization, which is not a verified trusted source. - [REMOTE_CODE_EXECUTION]: Runtime execution of remote code is performed via
npx -y @nomadamas/k-skill@0, allowing the execution of unverified logic during the setup phase. - [PERSISTENCE]: The instructions include automated scripts to create a daily cron job on Linux/macOS and a Scheduled Task on Windows for update checks, maintaining the tool's lifecycle on the host system.
- [COMMAND_EXECUTION]: The skill executes various system commands, including
npx,npm,gh api,crontab, andschtasksto manage the environment and external service interactions. - [CREDENTIALS_UNSAFE]: The skill establishes a pattern for storing sensitive API keys in a local file at
~/.config/k-skill/secrets.env. Although it includes a check for 0600 file permissions, local credential storage is a security surface area for potential exposure.
Audit Metadata