Skills
Navigate
skills/terminalskills/skills/xray/Gen Agent Trust Hub

xray

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill executes a remote bash script directly from GitHub using a piped command. This allows for arbitrary code execution on the host machine during the installation phase.
  • Evidence (SKILL.md): bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
  • [EXTERNAL_DOWNLOADS]: The skill downloads an installation script and related software components from github.com. While GitHub is a well-known service, the execution of unverified scripts at runtime carries security risks.
  • [COMMAND_EXECUTION]: The skill uses administrative commands such as systemctl to manage background services and apt to install dependencies like certbot.
  • Evidence (SKILL.md): systemctl enable --now xray and apt install -y certbot
Recommendations
  • HIGH: Downloads and executes remote code from: https://github.com/XTLS/Xray-install/raw/main/install-release.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 15, 2026, 09:51 PM
Security Audit — agent-trust-hub — xray