ascii-art
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install and use several standard Linux/macOS CLI utilities (e.g.,
apt install cowsay,pip install pyfiglet,brew install boxes). These are common development tools and the instructions follow standard installation practices. - [EXTERNAL_DOWNLOADS]: The skill fetches data from several well-known and trusted external services:
- GitHub's public API (
api.github.com/octocat) for ASCII art. - The weather service
wttr.in, which is a well-established community service for terminal-based weather reporting. - The FIGlet API
asciified.thelicato.ioand QR serviceqrenco.de, which are commonly used for terminal utilities. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download content from
ascii.co.ukusingcurland process it with a Python script. While the automated scanner flagged this as remote code execution, manual analysis shows thecurlcommand only downloads a static HTML file to/tmp, and the subsequent Python script performs safe regex extraction of text contained within<pre>tags. No downloaded content is executed as code; it is treated strictly as data (text art).
Audit Metadata