famou-experiment-manager
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages API keys by reading and writing to
~/.famou-ctl/settings.jsonvia a helper script. This is a standard practice for CLI tools but involves managing credentials in a predictable local file path. - [EXTERNAL_DOWNLOADS]: The skill requires the
famou-sdkpackage to be installed from a public registry. This dependency is necessary for the CLI tool's functionality and is consistent with the skill's purpose and vendor. - [COMMAND_EXECUTION]: The skill performs several command-line operations, including executing the
famou-ctlbinary for experiment management, searching for files usingfind, and running background processes withnohup. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from user-controlled files like
config.yamlandevaluator.pyto configure and run experiments, creating a surface for potential injection. - Ingestion points: Reads
config.yaml,evaluator.py,init.py, andprompt.mdfrom the local directory. - Boundary markers: Absent. The skill does not use specific delimiters or warnings to ignore instructions inside these files.
- Capability inventory: Can execute CLI commands, write to the filesystem, and manage background processes.
- Sanitization: Absent. The skill passes file content directly to the underlying CLI tool without pre-processing or escaping.
Audit Metadata