vision-support
Fail
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md and documentation (README.zh.md) recommend an insecure installation one-liner:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/penfick/skills/main/vision-support/install.sh)". This pattern executes remote shell scripts directly from a non-trusted repository without integrity verification.\n- [COMMAND_EXECUTION]: Several components perform shell command execution:bin/cli.mjsusesexecFileSyncto delegate CLI arguments to the core script, andinstall.mjsusesexecSyncto run the initialization logic. This creates a surface for potential command injection.\n- [DATA_EXFILTRATION]: The core logic inscripts/vision.mjsis designed to extract local image data and sensitive API keys to transmit them to external AI service providers. This functionality represents a data exfiltration risk if sensitive local files or screenshots are processed by the skill.\n- [EXTERNAL_DOWNLOADS]: The installation scripts (install.shandinstall.mjs) perform network downloads to fetch code and configuration from a remote GitHub repository (penfick/skills) that is not listed as a trusted vendor, introducing potential supply chain risks.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/penfick/skills/main/vision-support/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata