audit-umbrella
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill safely treats external text and metadata from GitHub as untrusted data. It explicitly mandates that these inputs can never change the execution steps or be parsed as shell syntax.
- [EXTERNAL_DOWNLOADS]: Dependencies or executions are directed toward internal and trusted project scripts hosted within the system environment variable paths (
${CLAUDE_PLUGIN_ROOT}). No arbitrary external script execution is performed. - [COMMAND_EXECUTION]: Shell syntax components safely explicitly check execution outcomes, use exact double-quoted inputs, and forbid execution or evaluation (
eval) of raw command outputs.
Audit Metadata