yds-setup
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch an installation script from
https://raw.githubusercontent.com/ymd38/dev-skills/main/harness/scripts/install.shand pipe it directly into thebashshell for execution. This method is used to bootstrap the harness components but bypasses local inspection before execution. - [COMMAND_EXECUTION]: The skill invokes the
npxtool to dynamically add external skills (ymd38/dev-skills) to the environment. It also recommends and configures various language-specific CLI tools (such asgo,uv,npm,pytest, andruff) to run as part of the project's standard operations. - [EXTERNAL_DOWNLOADS]: The skill downloads multiple project components, including hooks, rules, and scripts, from external GitHub repositories to set up the development harness.
- [DYNAMIC_EXECUTION]: The setup process generates and installs git hooks in the
.claude/hooks/directory. These hooks are designed to execute automatically during the development cycle (e.g., formatting on save, guarding against dangerous bash commands).
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/ymd38/dev-skills/main/harness/scripts/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata