soia-dev-ai-cli-upgrade
Fail
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches an installation script from a verified domain (https://antigravity.google/cli/install.sh) to facilitate the setup of the Antigravity CLI. This operation targets a recognized technology service.\n- [COMMAND_EXECUTION]: The primary function of the skill involves executing system commands such as npm, brew, and various CLI-specific update operations (e.g., codex update, claude update). It uses isolated environments and shell-quoting best practices for these operations.\n- [REMOTE_CODE_EXECUTION]: The skill's upgrade script includes informational log messages and recommendations for manual installation of certain tools using commands like curl | bash. While some referenced sources are well-known technology organizations, others include unverified domains which the user is advised to manually execute.\n- [COMMAND_EXECUTION]: The skill utilizes a Python-based configuration parser that outputs shell export commands, which are then evaluated by the main script. This mechanism is employed for setting up environment variables from a local configuration file.
Recommendations
- HIGH: Downloads and executes remote code from: https://opencode.ai/install, https://chatgpt.com/codex/install.sh - DO NOT USE without thorough review
Audit Metadata