Skills
Navigate
skills/reason-machines/trending-skills/free-code-claude-cli/Gen Agent Trust Hub

free-code-claude-cli

Fail

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides a 'one-liner' command to download and execute a shell script directly in the terminal from an untrusted source.
  • Evidence: curl -fsSL https://raw.githubusercontent.com/paoloanzn/free-code/main/install.sh | bash in SKILL.md.
  • [EXTERNAL_DOWNLOADS]: The skill fetches installation scripts and clones source code from a GitHub repository (paoloanzn/free-code) that is not identified as a trusted organization or well-known service.
  • Evidence: git clone https://github.com/paoloanzn/free-code.git and the raw content download at https://raw.githubusercontent.com/paoloanzn/free-code/main/install.sh.
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes an installation script from the official domain of the Bun runtime, which is a well-known service.
  • Evidence: curl -fsSL https://bun.sh/install | bash in SKILL.md.
  • [COMMAND_EXECUTION]: The skill involves piping remote content directly into the bash interpreter, which bypasses user review of the script content before execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill promotes a tool that specifically claims to 'strip Anthropic's injected system-prompt guardrails,' which describes a mechanism for bypassing safety controls in the underlying AI system.
Recommendations
  • HIGH: Downloads and executes remote code from: https://bun.sh/install, https://raw.githubusercontent.com/paoloanzn/free-code/main/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 12, 2026, 11:44 PM
Security Audit — agent-trust-hub — free-code-claude-cli