deanpeters-pm-skills
Fail
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and encourages the download of resources from an external GitHub repository (
github.com/deanpeters/Product-Manager-Skills). This repository is not associated with a trusted organization or the skill author's known infrastructure. - [REMOTE_CODE_EXECUTION]: The instructions direct the agent to use
npx skills add, a command pattern that involves the remote fetching and execution of code from an unverified source. This allows for the introduction of arbitrary external logic into the execution environment. - [COMMAND_EXECUTION]: The skill includes a 'Decision tree' that explicitly instructs the agent to perform shell operations, such as checking for file existence in the home directory (
~/.design-agent-skills/) and running installation commands. It also provides guidance on using the!command prefix in specific environments to execute commands.
Recommendations
- AI detected serious security threats
Audit Metadata