skill-sync
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Orchestrates various development and system tools including Git for version control,
uvfor Python tool management,cargofor Rust-based validation, andchezmoifor configuration synchronization. - [EXTERNAL_DOWNLOADS]: Communicates with the author's GitHub repository (
github.com/bengous/agents-skills) to push updates and pull skill content during initial installation. - [DYNAMIC_EXECUTION]: Triggers local validation routines and deployment scripts such as
scripts/publish-live,uv run pytest, andbun testto ensure skill integrity before deployment. - [INDIRECT_PROMPT_INJECTION]: Monitors repository status and file differences as part of its workflow. While these inputs originate from files being edited, they represent a potential ingestion point for instructions embedded in code or comments. The skill mitigates this through a structured, multi-step workflow and a policy that forbids implicit invocation.
Audit Metadata