Security audit
Security checks for vulnerabilities and agentic risk
The skill’s code-analysis workflow, local indexing, and optional agent integrations are clearly disclosed and fit its purpose.
Review the remote installer before running it, and configure only the agent integrations you want. Expect local dependency-graph files, review proposed code changes, and run project tests; Topos scores do not prove correctness or security.
The supplied chunk performs installation and integration setup rather than code evaluation or improvement. Although setup can support the declared purpose, registering an MCP server across every supported harness is a materially broader configuration action not disclosed in the description. The status check is a supporting verification step, not an independent mismatch.
The installation command downloads a mutable remote script and immediately executes it without verifying a pinned version, signature, or independently trusted digest. Compromise of the distribution endpoint could therefore execute arbitrary commands with the invoking user's privileges, including accessing repository contents and credentials; HTTPS does not protect against a compromised publisher.
Runtime dependencies:
curl -fsSL https://docs.krv.ai/topos/install.sh | bash
npm install -g gitnexus # enables COMPOSABLE / PLATINUM scoring
Piping the HTTP response directly into bash turns externally supplied bytes into shell commands without an intervening verification step. This confirms the same unsafe installation mechanism reported by SC2, not a separate exploit or evidence of malicious tool chaining; its documented installation purpose explains the command but does not remove the risk.
Runtime dependencies:
curl -fsSL https://docs.krv.ai/topos/install.sh | bash
npm install -g gitnexus # enables COMPOSABLE / PLATINUM scoring
No suspicious patterns detected.