bump-rust-sdk
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from
registry.npmjs.organd release data fromgithub.com/bitwarden/clients. These are well-known and trusted vendor sources, respectively.\n- [COMMAND_EXECUTION]: The skill performs various build and test operations usingcargo build,cargo test, anddotnet run. It also utilizes shell tools likecurl,tar, andgrepfor dependency management. These activities are legitimate for its dev-ops purpose.\n- [PROMPT_INJECTION]: The skill processes external repository metadata which introduces a potential indirect injection surface.\n - Ingestion points: Version strings are parsed from the
package.jsonfile in thebitwarden/clientsrepository viagit showin SKILL.md.\n - Boundary markers: Absent; the version string is directly interpolated into a
curlcommand string without delimiters.\n - Capability inventory: Access to shell command execution, build tools, and network operations as detailed in SKILL.md.\n
- Sanitization: Absent; the skill does not instruct the agent to validate or escape the version string before use.
Audit Metadata