skills/yikart/aitoearn/impeccable/Gen Agent Trust Hub

impeccable

Fail

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/live-copy-edit-agent.mjs executes the codex CLI tool with the --dangerously-bypass-approvals-and-sandbox flag, which explicitly disables security boundaries and user confirmation prompts in the target environment.
  • [COMMAND_EXECUTION]: The scripts/pin.mjs utility programmatically writes new skill files into the agent's harness directories (e.g., .agents/skills, .claude/skills), enabling the skill to persistently modify the agent's available command set across different sessions.
  • [EXTERNAL_DOWNLOADS]: The scripts/context.mjs file performs network requests to https://impeccable.style/api/version to check for version updates, which can be used to track usage or trigger conditional behavior.
  • [COMMAND_EXECUTION]: The scripts/cleanup-deprecated.mjs script performs automated deletion of files and directories within agent-specific hidden folders based on keyword matching, which could lead to accidental or malicious removal of other skills.
  • [COMMAND_EXECUTION]: The skill starts a local HTTP server (scripts/live-server.mjs) and performs extensive file system operations to inject scripts into project HTML files, creating a potential vector for local cross-origin attacks.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 24, 2026, 10:44 AM
Security Audit — agent-trust-hub — impeccable