impeccable
Fail
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/live-copy-edit-agent.mjsexecutes thecodexCLI tool with the--dangerously-bypass-approvals-and-sandboxflag, which explicitly disables security boundaries and user confirmation prompts in the target environment. - [COMMAND_EXECUTION]: The
scripts/pin.mjsutility programmatically writes new skill files into the agent's harness directories (e.g.,.agents/skills,.claude/skills), enabling the skill to persistently modify the agent's available command set across different sessions. - [EXTERNAL_DOWNLOADS]: The
scripts/context.mjsfile performs network requests tohttps://impeccable.style/api/versionto check for version updates, which can be used to track usage or trigger conditional behavior. - [COMMAND_EXECUTION]: The
scripts/cleanup-deprecated.mjsscript performs automated deletion of files and directories within agent-specific hidden folders based on keyword matching, which could lead to accidental or malicious removal of other skills. - [COMMAND_EXECUTION]: The skill starts a local HTTP server (
scripts/live-server.mjs) and performs extensive file system operations to inject scripts into project HTML files, creating a potential vector for local cross-origin attacks.
Recommendations
- AI detected serious security threats
Audit Metadata