asupersync-rust
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to configure Git-based dependencies targeting
https://github.com/Dicklesworthstone/asupersyncwithinCargo.toml. This allows the download and integration of external code from a source outside the predefined trusted vendor list. - [INDIRECT_PROMPT_INJECTION]: The skill documentation includes patterns for building web servers that ingest and process external network data, creating a surface for indirect prompt injection.
- Ingestion points: The
create_itemhandler andto_web_requestfunction inSKILL.mdextract untrusted data from HTTP request bodies (asupersync::web::extract::Json) and headers. - Boundary markers: The instructions do not define explicit prompt delimiters or "ignore instructions" markers for the processed data, although they mention protocol-level constraints.
- Capability inventory: The skill facilitates building Rust applications with capabilities for network listening (
Http1Listener), network requests, and standard file/system access inherent to the Rust runtime. - Sanitization: The skill recommends best practices such as
HostPolicy::allow_listand bounding request metadata, but lacks specific sanitization logic for data passed to an LLM context.
Audit Metadata