arkcli-connect

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The package includes a postinstall script (scripts/postinstall.js) that automatically executes the arkcli +connect command during the NPM installation process when an interactive terminal is present.
  • [DATA_EXPOSURE]: The skill scans the local file system for specific application paths associated with AI agents, such as ~/.claude/skills/, ~/.cursor/skills/, and ~/.agents/skills/, to identify installation targets.
  • [PERSISTENCE]: The skill installs instructional markdown content and configuration files into persistent agent skill directories, ensuring the availability of arkcli capabilities across future agent sessions.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes a pipeline for delivering managed AI instructions to multiple downstream agents. It mitigates potential ingestion risks by using an authoritative catalog and an ownership manifest (.arkcli-managed-skills.json) to track and validate content integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 04:17 PM
Security Audit — agent-trust-hub — arkcli-connect