llmfit-hardware-model-matcher
Fail
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's installation instructions recommend executing a script downloaded from an untrusted remote server (
https://llmfit.axjns.dev/install.sh) by piping it directly to the system shell (| sh). This pattern provides no opportunity for the user to inspect the code before it runs with the user's permissions. - [EXTERNAL_DOWNLOADS]: The skill references several external sources for installation, including an untrusted third-party domain (
axjns.dev), a personal GitHub repository (github.com/AlexsJones), and the GitHub Container Registry. - [COMMAND_EXECUTION]: The documentation includes multiple examples of shell commands and Python scripts that execute local binaries and system tools via
subprocess.runto perform hardware detection and interact with the local file system.
Recommendations
- HIGH: Downloads and executes remote code from: http://localhost:8787, https://llmfit.axjns.dev/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata