security-scan

Warn

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the ecc-agentshield package via npm install -g or npx. This package and its source code (github.com/affaan-m/agentshield) are provided by a third-party entity and are not from a verified or well-known organization.\n- [COMMAND_EXECUTION]: The instructions include multiple commands that execute the third-party binary, including commands that can modify the project configuration (npx ecc-agentshield init, npx ecc-agentshield scan --fix).\n- [DATA_EXFILTRATION]: The skill explicitly instructs the user to provide their ANTHROPIC_API_KEY (export ANTHROPIC_API_KEY=your-key) to the tool for deep analysis functionality. Sending sensitive credentials to an unverified third-party tool constitutes a potential data exfiltration risk.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 25, 2026, 05:24 AM