claude-theme
Fail
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to execute
npx lunary-theme, which downloads and runs code from the npm registry at runtime. - [REMOTE_CODE_EXECUTION]: Use of
npxfacilitates the execution of remote scripts on the host machine. The packagelunary-themeis not from a verified or trusted organization. - [COMMAND_EXECUTION]: The skill requires multiple Bash commands to modify system files, including patching existing application binaries.
- [DYNAMIC_EXECUTION]: The skill's primary function is to 'patch' the bundled JavaScript of another application (Claude Code). This involves direct modification of the application's logic, which is a high-risk operation that could be used to intercept data or alter the agent's behavior beyond cosmetic changes.
Recommendations
- AI detected serious security threats
Audit Metadata