remindb-setup
Fail
Audited by Gen Agent Trust Hub on May 24, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and execute shell scripts directly from a remote GitHub repository using piped execution methods.
- Evidence: The skill provides commands such as
curl -fsSL https://raw.githubusercontent.com/radimsem/remindb/main/install.sh | bashfor Linux/macOS andiwr -useb https://raw.githubusercontent.com/radimsem/remindb/main/install.ps1 | iexfor Windows inreferences/config-model.md. - [COMMAND_EXECUTION]: The agent is directed to perform extensive shell operations for environment discovery, tool invocation, and binary execution.
- Evidence: Use of
remindb compile,remindb --version, and host-specific installation commands likecodex plugin marketplace addandopenclaw plugins installacrossSKILL.mdandreferences/host-wiring.md. - [CREDENTIALS_UNSAFE]: The skill identifies and modifies sensitive configuration files belonging to other host applications to set environment variables.
- Evidence: Targeting of files such as
~/.claude/plugins/cache/.../.mcp.json,~/.codex/config.toml, and~/.config/opencode/opencode.jsonas detailed inreferences/host-wiring.md. This access poses a risk of host configuration corruption or exposure of embedded secrets. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of external components and plugins from public registries and marketplaces.
- Evidence: Instructions to use
npx skills@latest addand/plugin install remindb@remindbinreferences/host-wiring.md.
Recommendations
- AI detected serious security threats
Audit Metadata