famou-experiment-manager
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically installs or upgrades the 'famou-sdk' Python package to version 1.1.0 using pip. This is a core vendor dependency required for the skill's primary functionality.
- [COMMAND_EXECUTION]: Several shell commands are executed to manage the experiment environment, including 'find' for locating configuration files, 'realpath' for path resolution, and 'nohup' to run the evaluator worker as a background process.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it ingests untrusted data from local 'config.yaml' files.
- Ingestion points: Reads 'config.yaml' content from the current working directory in Step 2.2.
- Boundary markers: None identified; instructions do not specify delimiters or warnings for the agent when processing the configuration file.
- Capability inventory: The skill can execute subprocesses via 'famou-ctl' (Steps 2.5, 2.6, 2.7) and perform background execution using 'nohup' (Step 2.7.3).
- Sanitization: No explicit sanitization or validation of the YAML content is performed before interpolation into CLI commands.
Audit Metadata