actix-web-async
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to run
npm install actix-webin the 'Step-by-Step' section. Since Actix Web is a Rust-based framework (typically distributed via crates.io and managed by Cargo), the existence of an NPM package by the same name is highly suspicious. Installing software from an incorrect registry based on ecosystem mismatch is a primary vector for supply chain attacks. - [COMMAND_EXECUTION]: The documentation explicitly directs the agent or user to execute
npm install actix-weband subsequentlyactix-web --version. Running commands associated with potentially malicious or confusingly named packages can lead to arbitrary code execution on the system. - [NO_CODE]: The skill contains no actual functional code, implementation logic, or scripts. It consists entirely of placeholder comments and generic instructions. The combination of missing functionality and suspicious installation commands often characterizes malicious or low-quality skills designed to facilitate package installation.
Audit Metadata