zero
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Remote Script Execution: The skill performs a setup step using
curl -fsSL https://zerolang.ai/install.sh | bash. This pattern downloads and executes an external shell script to install the Zero toolchain, which is a point where external code is introduced to the system. - Dynamic Command and Skill Discovery: The skill is designed to load its full logic dynamically through the
zero skillscommand. This means the agent's behavior and available instructions are determined at runtime by the installed binary rather than being statically defined in the skill file. - System Path Modification: To enable the tool, the skill modifies the environment's
PATHvariable. While standard for software installation, it represents a change to the execution environment. - Execution of Subprocesses: The skill makes extensive use of the
zeroCLI to perform operations like querying, patching, and checking code, which involves spawning local subprocesses based on user projects.
Audit Metadata