mathodology-whole-project
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The
SKILL.mdfile contains instructions for the agent to download a Python script from a remote GitHub repository and execute it locally (curl | python3). This bypasses standard package management verification. - [EXTERNAL_DOWNLOADS]: The
scripts/update-project.pyscript performs network operations to fetch source archives fromcodeload.github.comand resolves repository references via the GitHub API. It also utilizesnpxanduvxto download and run software packages during execution. - [DYNAMIC_EXECUTION]: The
scripts/update-project.pyscript includes a hardcoded Python supervisor script that is executed at runtime viasys.executable -cto manage process lifecycles and timeouts. - [COMMAND_EXECUTION]: The skill executes multiple shell commands for file management, process termination, and environment configuration, including the use of
git,tar, andchmodin its backup and update scripts.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/sweetcornna/mathodology/main/.claude/skills/mathodology-whole-project/scripts/update-project.py - DO NOT USE without thorough review
Audit Metadata