One-click installation of GitHub projects

• Analyzed: May 15, 2026, 1:31 AM
• Findings: 1
• Version: 0.1.1
• Hash: 29102562ca46550a8421fdafbf2cdf0ae08e148ad7e8145a66d605ade2568a94
• Source: palm
• External report: View on VirusTotal

Findings (1)

The ginstall-oneclick skill is a wrapper for a CLI tool designed to automate the cloning, dependency installation, and execution of Node.js projects from GitHub. The instructions in SKILL.md and README.md are well-documented and include security best practices, such as explicitly advising the agent and user not to leak GITHUB_TOKEN in chat and recommending quoted arguments to prevent shell injection. While the skill facilitates high-risk actions (executing code from remote repositories), these actions are central to its stated purpose and lack any evidence of malicious intent or unauthorized data exfiltration.