vim
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill follows standard instructional patterns to guide the agent in responding to Vim-related queries. No evidence of behavior overrides, safety filter bypasses, or system prompt extraction was found.
- [DATA_EXPOSURE_AND_EXFILTRATION]: There are no hardcoded credentials, sensitive file path accesses, or network operations. The skill acts entirely locally as a static reference.
- [OBFUSCATION]: Analysis for Base64 encoding, zero-width characters, homoglyphs, and hidden URL patterns yielded no results. The content is provided in plain markdown.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill does not perform any external package installations (pip, npm) or remote script downloads. It has no external dependencies.
- [PRIVILEGE_ESCALATION]: No commands for escalating user privileges (such as sudo, chmod, or registry modifications) are present.
- [PERSISTENCE_MECHANISMS]: The skill does not attempt to modify shell profiles, cron jobs, or startup services to maintain persistence.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-supplied queries, it lacks the dangerous capabilities (like network access or file system writing) required for a successful injection attack. It only outputs pre-defined markdown tables.
- [DYNAMIC_EXECUTION]: The skill contains a shell variable assignment example (
QUERY="$*") within its documentation, but this is purely descriptive and does not execute arbitrary code at runtime.
Audit Metadata