fiftyone-voodo-design
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file contains a command
curl -sL skil.sh | shwhich downloads and immediately executes a shell script from an external, non-standard domain. This pattern is a significant security risk as the script's contents are not verified and can change at any time. - [EXTERNAL_DOWNLOADS]: The skill instructions mandate using
WebFetchto download an external markdown file fromhttps://voodo.dev.fiftyone.ai/voodo-llm-reference.md. This reference is used to guide the AI's code generation, introducing a dependency on remote content hosted on a vendor-controlled subdomain. - [COMMAND_EXECUTION]: The installation process involves executing shell commands to fetch and install the
voxel51/fiftyone-skillsrepository, which may lead to further unverified actions on the user's system. - [EXTERNAL_DOWNLOADS]: The skill relies on the
@voxel51/voodonpm package, which is a legitimate vendor resource but constitutes an external dependency managed at runtime.
Audit Metadata