skills/tt-a1i/hermes-agent/ascii-art/Gen Agent Trust Hub

ascii-art

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to install and use several standard Linux/macOS CLI utilities (e.g., apt install cowsay, pip install pyfiglet, brew install boxes). These are common development tools and the instructions follow standard installation practices.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from several well-known and trusted external services:
  • GitHub's public API (api.github.com/octocat) for ASCII art.
  • The weather service wttr.in, which is a well-established community service for terminal-based weather reporting.
  • The FIGlet API asciified.thelicato.io and QR service qrenco.de, which are commonly used for terminal utilities.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download content from ascii.co.uk using curl and process it with a Python script. While the automated scanner flagged this as remote code execution, manual analysis shows the curl command only downloads a static HTML file to /tmp, and the subsequent Python script performs safe regex extraction of text contained within <pre> tags. No downloaded content is executed as code; it is treated strictly as data (text art).
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:47 PM
Security Audit — agent-trust-hub — ascii-art