arkcli-connect
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The package includes a
postinstallscript (scripts/postinstall.js) that automatically executes thearkcli +connectcommand during the NPM installation process when an interactive terminal is present. - [DATA_EXPOSURE]: The skill scans the local file system for specific application paths associated with AI agents, such as
~/.claude/skills/,~/.cursor/skills/, and~/.agents/skills/, to identify installation targets. - [PERSISTENCE]: The skill installs instructional markdown content and configuration files into persistent agent skill directories, ensuring the availability of
arkclicapabilities across future agent sessions. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a pipeline for delivering managed AI instructions to multiple downstream agents. It mitigates potential ingestion risks by using an authoritative catalog and an ownership manifest (
.arkcli-managed-skills.json) to track and validate content integrity.
Audit Metadata