p-skill-installer
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use
npx --yes skillsto download and run a utility from the npm registry. The--yesflag is explicitly included to bypass user confirmation prompts during the download and execution phase. - [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands to function, including
npx,git, andgit ls-remote. These commands are used to clone repositories, verify network connectivity to GitHub, and manage local files in~/.agents/skills. - [REMOTE_CODE_EXECUTION]: By invoking
npx, the skill performs remote code execution. The use of a generic package name likeskillswithout a specific version or organization scope increases the risk of executing unintended or malicious code if the package name is hijacked or typo-squatted on the npm registry.
Audit Metadata