famou-experiment-manager

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill manages API keys by reading and writing to ~/.famou-ctl/settings.json via a helper script. This is a standard practice for CLI tools but involves managing credentials in a predictable local file path.
  • [EXTERNAL_DOWNLOADS]: The skill requires the famou-sdk package to be installed from a public registry. This dependency is necessary for the CLI tool's functionality and is consistent with the skill's purpose and vendor.
  • [COMMAND_EXECUTION]: The skill performs several command-line operations, including executing the famou-ctl binary for experiment management, searching for files using find, and running background processes with nohup.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from user-controlled files like config.yaml and evaluator.py to configure and run experiments, creating a surface for potential injection.
  • Ingestion points: Reads config.yaml, evaluator.py, init.py, and prompt.md from the local directory.
  • Boundary markers: Absent. The skill does not use specific delimiters or warnings to ignore instructions inside these files.
  • Capability inventory: Can execute CLI commands, write to the filesystem, and manage background processes.
  • Sanitization: Absent. The skill passes file content directly to the underlying CLI tool without pre-processing or escaping.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 11:59 AM