maker-setup
Fail
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from the GitHub repository
moremas/build-with-claudeusing eithergit cloneorcurl. The source repository is not associated with a known trusted organization or the skill author. - [REMOTE_CODE_EXECUTION]: After downloading the repository, the skill instructs the agent to run
onboard/scripts/onboard.py. This pattern of downloading and then executing code from an external, untrusted source is a significant security risk as the remote content can be modified to include malicious payloads. - [COMMAND_EXECUTION]: The skill utilizes system commands such as
curl,tar, andpythonto download, extract, and execute external content on the host machine.
Recommendations
- AI detected serious security threats
Audit Metadata