woop
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests the manual installation of the
vidbyte-skillspackage via npm to enable specific features, but does not perform the installation itself. - [COMMAND_EXECUTION]: The skill generates a shell command block (
vidbyte retain) derived from user input. The instructions explicitly mandate that this block must be displayed for the user and not executed or submitted automatically. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input for the Wish, Outcome, Obstacle, and Plan phases. It mitigates risk by implementing specific evaluation gates, requiring manual confirmation of feasibility, and instructing the agent to quote shell arguments safely when generating command blocks.
- [DATA_EXPOSURE]: The skill persists user goals and obstacles to local markdown files. It includes a mandatory privacy warning and provides the user with an option to redact sensitive information before saving.
Audit Metadata