security-scan
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
ecc-agentshieldpackage vianpm install -gornpx. This package and its source code (github.com/affaan-m/agentshield) are provided by a third-party entity and are not from a verified or well-known organization.\n- [COMMAND_EXECUTION]: The instructions include multiple commands that execute the third-party binary, including commands that can modify the project configuration (npx ecc-agentshield init,npx ecc-agentshield scan --fix).\n- [DATA_EXFILTRATION]: The skill explicitly instructs the user to provide theirANTHROPIC_API_KEY(export ANTHROPIC_API_KEY=your-key) to the tool for deep analysis functionality. Sending sensitive credentials to an unverified third-party tool constitutes a potential data exfiltration risk.
Audit Metadata