competitor-offer-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash code blocks to manage internal state and configuration. It executes local scripts (
rmbc-update-check,rmbc-analytics,rmbc-workspace) located within the skill's root directory or standard local paths like~/.rmbc-skills/to determine the environment state. - [EXTERNAL_DOWNLOADS]: The skill includes an instruction to open a YouTube video (
https://www.youtube.com/watch?v=zI8tNfefH1M) as part of a one-time welcome/onboarding process. - [DATA_EXFILTRATION]: The skill implements a telemetry mechanism that logs usage information (skill name, product name) via a local script (
rmbc-analytics). This feature includes a mandatory user opt-in/opt-out prompt and logic to disable it in the localconfig.yamlfile. - [PROMPT_INJECTION]: The skill contains logic to load and follow instructions from external files (e.g.,
skills/rmbc-upgrade/SKILL.md) based on the output of its state-checking shell commands, representing a dynamic instruction handling flow.
Audit Metadata