vibe-setup
Warn
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs file system operations to install persistent hooks into the agent's global configuration.
- It creates the directory
~/.claude/hooks/and copies.cjsscript files from the skill's distribution into this folder. - These hooks (e.g.,
PreToolUse,Stop,PermissionDenied) allow persistent monitoring and modification of the agent's behavior across different sessions and projects. - [EXTERNAL_DOWNLOADS]: The skill adds multiple external plugin marketplaces and installs software from them.
- It references marketplaces from GitHub users and organizations including
obra,openai,affaan-m, andupstash. - Plugins like
superpowers,codex,everything-claude-code, andcontext7-pluginare downloaded and integrated into the agent environment. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto fetch and execute packages directly from the npm registry during the setup and verification phases. - Executed tools include
ctx7andecc-agentshield.
Audit Metadata