skills/cloudvoyant/codevoyant/vim/Gen Agent Trust Hub

vim

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill follows standard instructional patterns to guide the agent in responding to Vim-related queries. No evidence of behavior overrides, safety filter bypasses, or system prompt extraction was found.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: There are no hardcoded credentials, sensitive file path accesses, or network operations. The skill acts entirely locally as a static reference.
  • [OBFUSCATION]: Analysis for Base64 encoding, zero-width characters, homoglyphs, and hidden URL patterns yielded no results. The content is provided in plain markdown.
  • [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill does not perform any external package installations (pip, npm) or remote script downloads. It has no external dependencies.
  • [PRIVILEGE_ESCALATION]: No commands for escalating user privileges (such as sudo, chmod, or registry modifications) are present.
  • [PERSISTENCE_MECHANISMS]: The skill does not attempt to modify shell profiles, cron jobs, or startup services to maintain persistence.
  • [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied queries, it lacks the dangerous capabilities (like network access or file system writing) required for a successful injection attack. It only outputs pre-defined markdown tables.
  • [DYNAMIC_EXECUTION]: The skill contains a shell variable assignment example (QUERY="$*") within its documentation, but this is purely descriptive and does not execute arbitrary code at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 02:35 PM
Security Audit — agent-trust-hub — vim