feedback-generator
Warn
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill contains a shell script block intended to submit feedback logs via a CLI tool. It uses
python3 -m cli feedback submitwith arguments like--domainand--conversation-idthat are derived from user session data. This presents a risk of command injection if the agent interpolates unsanitized user-provided strings into the shell execution environment. - [EXTERNAL_DOWNLOADS]: The instructions suggest the installation of an external package
vidbyte-skillsvianpm install -g vidbyte-skillsif the CLI is not present. This encourages the user or agent to download and install third-party code from a public registry. - [DATA_EXPOSURE]: In 'Passive Mode', the skill automatically writes session feedback logs to a local
skillsdirectory. While intended for logging, this behavior involves writing data inferred from user conversations to the local file system without explicit per-action confirmation.
Audit Metadata