creative-brief

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local shell commands and binaries to manage environment initialization and state.
  • It executes rmbc-update-check and rmbc-analytics from the skill's root directory to handle versioning and usage logging.
  • It modifies its own configuration at ~/.rmbc-skills/config.yaml using sed based on user-provided telemetry choices.
  • It invokes rmbc-workspace using text provided by the user via AskUserQuestion, which introduces a surface for command injection if the input is not sanitized.
  • [EXTERNAL_DOWNLOADS]: The skill provides an option to open external educational content from a well-known service.
  • Evidence: The skill uses the open command to launch a YouTube video URL during the one-time welcome flow.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 01:36 PM
Security Audit — agent-trust-hub — creative-brief