skill-sync

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Orchestrates various development and system tools including Git for version control, uv for Python tool management, cargo for Rust-based validation, and chezmoi for configuration synchronization.
  • [EXTERNAL_DOWNLOADS]: Communicates with the author's GitHub repository (github.com/bengous/agents-skills) to push updates and pull skill content during initial installation.
  • [DYNAMIC_EXECUTION]: Triggers local validation routines and deployment scripts such as scripts/publish-live, uv run pytest, and bun test to ensure skill integrity before deployment.
  • [INDIRECT_PROMPT_INJECTION]: Monitors repository status and file differences as part of its workflow. While these inputs originate from files being edited, they represent a potential ingestion point for instructions embedded in code or comments. The skill mitigates this through a structured, multi-step workflow and a policy that forbids implicit invocation.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 10:13 PM