external-skill-installation
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill facilitates the download and execution of untrusted code by instructing the agent to use 'npx skills add' and 'git clone' with arbitrary repository names.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to 'raw.githubusercontent.com' and 'github.com' to fetch and install external assets and code repositories.
- [PRIVILEGE_ESCALATION]: The documentation recommends the use of 'sudo' to overcome permission issues when copying installed skills, potentially allowing malicious code to bypass system restrictions.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a process to ingest and evaluate remote 'SKILL.md' files, which can contain adversarial instructions. 1. Ingestion points: Fetches content from remote GitHub URLs via 'curl'. 2. Boundary markers: None; the agent processes the raw file content. 3. Capability inventory: The agent is instructed to use 'npx', 'git', and 'sudo' to act on the evaluated content. 4. Sanitization: No input validation or sanitization is performed on the fetched content.
- [COMMAND_EXECUTION]: The skill utilizes several powerful system commands including 'npx', 'git', 'cp', and 'unzip' to manage the installation lifecycle.
Recommendations
- AI detected serious security threats
Audit Metadata