scout
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the local system by executing shell commands via
npx vskill. This includes listing installed skills, searching the registry, performing installations, and managing updates or removals. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading and installing external content from the
verified-skill.comregistry and GitHub repositories. It provides specific instructions to differentiate between official vendor plugins (which are pre-verified) and third-party skills, recommending manual inspection and security scans for the latter. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from registry search results. To mitigate potential risks from malicious metadata in the registry, the skill defines a strict workflow for presenting results (tables with tiers and scores) and requires the agent to explain trust tiers to the user, ensuring informed consent before any installation occurs.
Audit Metadata