create-yaml-tests
Warn
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's main entry point (SKILL.md) contains instructions to periodically run 'npx -y skills@latest update -y'. This downloads the latest version of the 'skills' package from the npm registry whenever the daily update check triggers.\n- [REMOTE_CODE_EXECUTION]: The use of 'npx -y skills@latest update -y' results in the execution of remote code. The package name 'skills' is highly generic and not scoped to the vendor (e.g., @shiplightai/skills), which increases the risk of package hijacking or typosquatting attacks in the public registry. Furthermore, the use of the '@latest' tag prevents version verification before execution.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for maintenance ('npx skills update') and project management ('npm test', 'npm run test:headed'). While typical for development tools, the automated execution of an unversioned remote package is a significant security concern.
Audit Metadata