skills/carapace-sh/carapace/cmd-clink/Gen Agent Trust Hub

cmd-clink

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a knowledge base for Clink, providing detailed documentation for its Lua API and GNU Readline integration. All referenced files are instructional and focus on providing valid technical guidance for shell enhancement.
  • [SAFE]: The skill describes legitimate shell integration mechanisms, such as DLL injection into cmd.exe and the use of the HKCU\Software\Microsoft\Command Processor\AutoRun registry key. These are standard features of the Clink tool for providing persistent shell enhancements.
  • [SAFE]: The reference materials include benign examples of Lua code for generating completion matches, coloring input text, and configuring key bindings. These examples follow industry-standard practices for shell customization.
  • [SAFE]: While the documentation mentions capabilities such as HTTP requests and external process execution (popen) within Clink's Lua environment, these are described solely as available API features without any malicious implementation or data exfiltration patterns.
  • [SAFE]: No obfuscation, prompt injection attempts, or hardcoded credentials were found in the skill metadata or body.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 04:25 PM