Is zysilm-ai/skill-master safe?
Use with caution. zysilm-ai/skill-master is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the skill-master skill by zysilm-ai a trust score of 71/100 with 4 findings (2 high).
https://github.com/zysilm-ai/skill-master
Is zysilm-ai/skill-master safe to install?
This skill implements a sophisticated skill orchestration system that searches GitHub for external skills, downloads them, and executes them dynamically. While the functionality appears legitimate, it creates significant security risks through potential supply chain attacks and dynamic code execution.
What security issues were found in zysilm-ai/skill-master?
Category Scores
Findings (4)
HIGH Dynamic External Skill Execution -40 ▶
The skill downloads external SKILL.md files from GitHub repositories and executes them using the Skill tool. This creates a significant security risk as it could execute malicious skills from compromised repositories.
HIGH Supply Chain Attack Vector -50 ▶
The skill searches GitHub repositories for skills and can execute them, creating a supply chain attack vector. An attacker could compromise a skill repository and have this skill automatically find and execute malicious content.
MEDIUM Dynamic Skill Creation -18 ▶
The skill can create new SKILL.md files based on research and immediately execute them. This could be exploited if the research phase is manipulated to create malicious skills.
MEDIUM Complex Agent Spawning -32 ▶
The skill spawns fresh agents using the Task tool with user-controllable context, which could potentially be exploited for prompt injection attacks.
Should I install zysilm-ai/skill-master?
Oathe's verdict for zysilm-ai/skill-master is CAUTION with a trust score of 71/100. Recommendation: Install with caution.