product-position
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of external code from a third-party repository (
github.com/firatcand/founder-skills) using thenpx skills addcommand. This source is not part of the established trusted vendor or organization lists. - [COMMAND_EXECUTION]: The instructions provide multiple shell commands, including environment checks (
grep) and package installation (npx), intended to modify the local agent environment and install additional software. - [REMOTE_CODE_EXECUTION]: By instructing the agent to run
npx skills add, the skill triggers the execution of remote scripts from an unverified community contributor to complete the installation process.
Audit Metadata