install-spinner
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a list of available themes from the GitHub API and downloads specific theme files (JSON) from the author's public repository (alexpl292/awesome-claude-spinners).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from GitHub which is then used to update local configuration. \n
- Ingestion points: GitHub API and raw file content (SKILL.md).\n
- Boundary markers: Absent; the instructions do not include specific delimiters for the fetched data.\n
- Capability inventory: The skill has the ability to read and write to the local configuration file ~/.claude/settings.json (SKILL.md).\n
- Sanitization: The skill relies on the agent to correctly parse the JSON and only extract the relevant spinnerVerbs field.
Audit Metadata