email-promo
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various local binaries and scripts for maintenance and state management, specifically
rmbc-update-check,rmbc-analytics, andrmbc-workspacelocated within the framework's root directory. - [COMMAND_EXECUTION]: After completing the main task, the skill prompts for user input (product/offer name) and passes that input directly into a shell command (
/bin/rmbc-workspace active "<user's answer>"), which could allow for command injection if the input is not sanitized by the execution environment. - [DATA_EXFILTRATION]: Includes a telemetry reporting feature that logs skill and product usage via the
rmbc-analyticsbinary. This feature is presented to the user with an explicit opt-in/opt-out choice and a description of what is tracked. - [EXTERNAL_DOWNLOADS]: Contains instructions to open an external YouTube video using the system
opencommand for instructional content. - [COMMAND_EXECUTION]: Performs file system operations to maintain configuration and state, including creating directories and files in
~/.rmbc-skills/and modifying configuration viasedandgrep.
Audit Metadata