email-promo

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various local binaries and scripts for maintenance and state management, specifically rmbc-update-check, rmbc-analytics, and rmbc-workspace located within the framework's root directory.
  • [COMMAND_EXECUTION]: After completing the main task, the skill prompts for user input (product/offer name) and passes that input directly into a shell command (/bin/rmbc-workspace active "<user's answer>"), which could allow for command injection if the input is not sanitized by the execution environment.
  • [DATA_EXFILTRATION]: Includes a telemetry reporting feature that logs skill and product usage via the rmbc-analytics binary. This feature is presented to the user with an explicit opt-in/opt-out choice and a description of what is tracked.
  • [EXTERNAL_DOWNLOADS]: Contains instructions to open an external YouTube video using the system open command for instructional content.
  • [COMMAND_EXECUTION]: Performs file system operations to maintain configuration and state, including creating directories and files in ~/.rmbc-skills/ and modifying configuration via sed and grep.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 01:36 PM
Security Audit — agent-trust-hub — email-promo