skills/tw93/mole/release-notes/Gen Agent Trust Hub

release-notes

Fail

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: CRITICALCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses gh release edit, git log, and various shell scripts (scripts/test.sh, scripts/check.sh, scripts/post-reactions.sh) to manage the release workflow. These are all standard development tasks scoped to the project's repository.
  • [EXTERNAL_DOWNLOADS]: The skill references https://mole.fit/ and https://mole.fit/download as the official landing page and download source for the project's GUI application. Although these were flagged by automated scanners, they are legitimate vendor resources for the 'tw93' author and match the skill's context. The skill also fetches a logo from https://cdn.tw93.fun/, which is another vendor-owned domain.
  • [SAFE]: The scripts/post-reactions.sh script uses the official GitHub API (gh api) to post reactions to specific releases. This is a common automation task and does not involve unauthorized data access or persistence mechanisms.
  • [SAFE]: The frontmatter includes disable-model-invocation: true, which restricts the agent from performing actions without explicit user interaction, providing a significant safety boundary against autonomous misuse.
Recommendations
  • Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Aug 24, 2026, 09:30 AM
Security Audit — agent-trust-hub — release-notes