skills/timblazing/skills/impeccable/Gen Agent Trust Hub

impeccable

Fail

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill's live-copy-edit-agent.mjs script executes the codex and claude CLI tools using flags that bypass security sandboxes and permission prompts (--dangerously-bypass-approvals-and-sandbox and --permission-mode bypassPermissions). This allows external AI models to modify project source code without standard user oversight or safety constraints.
  • [COMMAND_EXECUTION]: Multiple scripts execute local system commands including git (for status, diffs, and ignoring files), node (to run internal helpers), and network port probing via node:net to detect and interact with development servers.
  • [EXTERNAL_DOWNLOADS]: The context.mjs script performs an automated network request to https://impeccable.style/api/version to check for skill updates. While checking for updates is a common feature, it involves un-whitelisted external network access.
  • [DATA_EXFILTRATION]: The 'live mode' functionality establishes a local HTTP server (live-server.mjs) that communicates with external browsers and potentially routes local project data through external AI agents via the polling and application protocol.
  • [COMMAND_EXECUTION]: The pin.mjs script programmatically creates new skill directories and SKILL.md files within the AI agent's configuration folders (.claude/skills, .agents/skills, etc.), effectively modifying the agent's capabilities and persistent environment.
  • [DATA_EXFILTRATION]: The detector module utilizes Puppeteer (detect-url.mjs) to render and scan arbitrary URLs, which involves full network access and the execution of remote web content in a headless browser environment.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 16, 2026, 05:55 PM