team-skills
Warn
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's primary function is to download and install new agent instructions from URLs specified in a
.skills.jsonfile. This creates a remote code execution vector if the manifest or the remote server is untrusted. - [COMMAND_EXECUTION]: The skill uses user-supplied arguments to define the installation path for skills. Without proper sanitization, this could be exploited via path traversal to write files to unauthorized directories.
- [EXTERNAL_DOWNLOADS]: The skill fetches external content over HTTPS to facilitate the onboarding and installation of remote team skills.
Audit Metadata