evolution
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs downloading an installation script (
install.sh) from an unverified external GitHub repository (github.com/ZhangHanDong/makepad-skills). - [REMOTE_CODE_EXECUTION]: The downloaded script is executed via
bash, introducing a risk of arbitrary remote code execution if the upstream repository is compromised or modified. - [COMMAND_EXECUTION]: The installation sets up persistent hooks within
.claude/settings.json(UserPromptSubmit,PreToolUse,PostToolUse) that automatically execute local shell scripts when prompts are sent or tools are invoked.
Recommendations
- AI detected serious security threats
Audit Metadata