asupersync-rust

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to configure Git-based dependencies targeting https://github.com/Dicklesworthstone/asupersync within Cargo.toml. This allows the download and integration of external code from a source outside the predefined trusted vendor list.
  • [INDIRECT_PROMPT_INJECTION]: The skill documentation includes patterns for building web servers that ingest and process external network data, creating a surface for indirect prompt injection.
  • Ingestion points: The create_item handler and to_web_request function in SKILL.md extract untrusted data from HTTP request bodies (asupersync::web::extract::Json) and headers.
  • Boundary markers: The instructions do not define explicit prompt delimiters or "ignore instructions" markers for the processed data, although they mention protocol-level constraints.
  • Capability inventory: The skill facilitates building Rust applications with capabilities for network listening (Http1Listener), network requests, and standard file/system access inherent to the Rust runtime.
  • Sanitization: The skill recommends best practices such as HostPolicy::allow_list and bounding request metadata, but lacks specific sanitization logic for data passed to an LLM context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 06:07 AM