no-mistakes
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file contains a command to download and execute a shell script directly from a remote GitHub repository (https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh | sh). This represents a significant security risk as the script's contents are not verified before execution.\n- [EXTERNAL_DOWNLOADS]: The skill encourages the installation of the 'no-mistakes' tool from an unverified third-party GitHub account.\n- [COMMAND_EXECUTION]: The skill's primary function is to drive the 'no-mistakes' command-line tool. Because the tool is installed via an unverified remote script, executing it allows for the potential execution of malicious code in the local environment.\n- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8).\n
- Ingestion points: The agent processes output from the 'no-mistakes axi' command (documented in SKILL.md), which includes finding descriptions from external sources.\n
- Boundary markers: None are specified; the agent is not instructed to treat the findings as untrusted data.\n
- Capability inventory: The agent can execute shell commands (git, no-mistakes) and modify the repository.\n
- Sanitization: None; the instructions explicitly mandate relaying findings 'verbatim,' creating a direct path for injected instructions to reach the user or influence the agent's next steps.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata