CLI-Hub Skill for CLI-Anything

• Analyzed: Apr 10, 2026, 3:51 PM
• Findings: 1
• Version: 1.0.1
• Hash: b53b6536d66ad8d13d0dd56d437ed35a1752bee610e1b364fc24ff5e6046a863
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill functions as a gateway to a third-party ecosystem, instructing the agent to install external software via 'pip install cli-anything-hub' and subsequent 'cli-hub install' commands. This pattern introduces significant supply chain risks by directing the agent to fetch and execute arbitrary Python packages from a custom registry hosted at clianything.cc. While the stated intent is to provide agent-native interfaces for professional software, the lack of verification for these external packages and the broad execution capabilities they provide constitute a high-risk behavior.