supsub-search
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command
curl -fsSL https://raw.githubusercontent.com/SupSub-AI/supsub-cli/master/scripts/install.sh | bash. This pattern involves piping a remote script directly into a shell interpreter. However, per the vendor context, 'SupSub-AI' is the author of this skill, and the repository is their official distribution channel. This represents a standard 'bootstrap' installation method for their own CLI tool. - [COMMAND_EXECUTION]: The skill executes local CLI commands such as
supsub search,supsub sub list,supsub focus list, andsupsub auth login. These are functional requirements for the skill's purpose and interact with the vendor's authenticated service. - [EXTERNAL_DOWNLOADS]: The skill references downloads from
npmjs.com(npm i -g @supsub/cli) andgithubusercontent.com. Both are well-known services and the packages belong to the official vendor namespace (@supsub), making them safe references within this context.
Audit Metadata