soia-meta-publish-market
Fail
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions advise users to install a command-line utility by piping a script from a remote URL (
https://skillhub.cn/install/install.sh) directly intobash. This pattern executes unverified code from a remote source with the user's privileges, posing a risk of arbitrary code execution. - [EXTERNAL_DOWNLOADS]: The documentation provides a command to install a global Node.js package (
@xhs/skillhub-upload) directly from a specific URL on a CDN (https://fe-video-qc.xhscdn.com/...). By installing from an arbitrary URL instead of the official registry, the skill bypasses security auditing and checksum verification mechanisms. - [COMMAND_EXECUTION]: The included Python script
scripts/stage_for_market.pyuses thesubprocessmodule to executegitandunittestcommands. While necessary for its core functionality of staging skills, this capability allows the execution of system-level commands based on user-provided repository paths.
Recommendations
- HIGH: Downloads and executes remote code from: https://skillhub.cn/install/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata