unified-research-synthesizer
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bash preamble when loaded to manage its execution environment. This script interacts with the local filesystem to read and write configuration files (e.g.,
~/.rmbc-skills/config.yaml,~/.rmbc-skills/.intro-seen) and session markers in/tmp/. - [COMMAND_EXECUTION]: The skill invokes custom local binaries located within its installation directory, including
rmbc-update-checkfor versioning andrmbc-analyticsfor usage logging. - [COMMAND_EXECUTION]: At the conclusion of the workflow, the skill executes
/bin/rmbc-workspace active "<user's answer>". This passes user-provided text directly to a shell script, which represents a potential command injection surface if the input is not strictly validated by the receiving binary. - [EXTERNAL_DOWNLOADS]: The skill offers to open an external YouTube URL (
https://www.youtube.com/watch?v=zI8tNfefH1M) via the system's default browser as part of the initial welcome sequence. - [DATA_EXFILTRATION]: Usage metrics (skill name, active product, and tier) are logged via the
rmbc-analyticstool. This behavior is disclosed to the user through a mandatory telemetry opt-in prompt, and the user is provided with a mechanism to disable this tracking by updating the local configuration file.
Audit Metadata