dark-pattern-audit
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the
npx skills addcommand to download and install its primary logic from an external GitHub repository (SidKH/skills). This pattern involves executing code and configuration from a source that is not a well-known service or trusted organization. - [COMMAND_EXECUTION]: The skill provides a decision tree for installation that requires the execution of several shell commands, including
grep,echo, and file existence checks ([ -f ... ]). The installation command itself uses the-yflag, which bypasses confirmation when executing thenpxpackage, reducing user oversight during the deployment of external code.
Audit Metadata