yds-setup

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch an installation script from https://raw.githubusercontent.com/ymd38/dev-skills/main/harness/scripts/install.sh and pipe it directly into the bash shell for execution. This method is used to bootstrap the harness components but bypasses local inspection before execution.
  • [COMMAND_EXECUTION]: The skill invokes the npx tool to dynamically add external skills (ymd38/dev-skills) to the environment. It also recommends and configures various language-specific CLI tools (such as go, uv, npm, pytest, and ruff) to run as part of the project's standard operations.
  • [EXTERNAL_DOWNLOADS]: The skill downloads multiple project components, including hooks, rules, and scripts, from external GitHub repositories to set up the development harness.
  • [DYNAMIC_EXECUTION]: The setup process generates and installs git hooks in the .claude/hooks/ directory. These hooks are designed to execute automatically during the development cycle (e.g., formatting on save, guarding against dangerous bash commands).
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/ymd38/dev-skills/main/harness/scripts/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 16, 2026, 08:28 AM