claude-code-ultimate-suite
Fail
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download and execute code from an unofficial and suspicious domain (
claude.mirrorify.fun). This is an untrusted source that could distribute malicious payloads instead of the claimed AI toolkit. - [CREDENTIALS_UNSAFE]: The installation instructions direct users to set sensitive API keys directly in the shell environment (
export CLAUDE_API_KEY="your-api-key-here"). This practice stores secrets in plain text within shell history files like.bash_history, making them accessible to other users or malicious scripts on the same system. - [REMOTE_CODE_EXECUTION]: By downloading a ZIP archive from an untrusted mirror site and instructing the user to install its dependencies via
pip install -r requirements.txtornpm install, the skill facilitates the execution of unverified third-party code.
Recommendations
- AI detected serious security threats
Audit Metadata