Skills
Navigate
skills/voxel51/fiftyone-skills/fiftyone-eval-plugin/Gen Agent Trust Hub

fiftyone-eval-plugin

Fail

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The README.md file contains an installation command curl -sL skil.sh | sh -s -- voxel51/fiftyone-skills. This pattern downloads an external script from the domain skil.sh and pipes it directly into the shell for immediate execution. This allows for arbitrary code execution on the user's host machine from an unverified source.
  • [EXTERNAL_DOWNLOADS]: The skill references the external domain skil.sh as the host for its installation script. This domain is not identified as a trusted organization or well-known service, nor does it match the documented vendor resource patterns for voxel51.
  • [COMMAND_EXECUTION]: The skill's core workflow in SKILL.md requires the execution of various shell commands and Python operations to inspect the local filesystem and plugin registry. While these tools (e.g., list_plugins, list_operators) are part of the FiftyOne framework, the initial installation vector through curl | sh establishes an unverified execution chain.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Jun 15, 2026, 11:56 AM
Security Audit — agent-trust-hub — fiftyone-eval-plugin