vsl-script

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several local shell scripts (rmbc-update-check, rmbc-analytics, rmbc-workspace) to manage environment state and telemetry. These are stored within the skill's local directory structure and represent standard functional components.
  • [DATA_EXFILTRATION]: The skill logs usage statistics via a local script. This telemetry is disclosed to the user and requires an explicit, one-time opt-in via an interactive prompt before any data is processed.
  • [EXTERNAL_DOWNLOADS]: The skill provides a link to a YouTube video for user training and performs version checks against the vendor's repository. These are typical behaviors for development-oriented tools.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for product descriptions and audience analysis to generate sales scripts.
  • Ingestion points: Inputs defined in SKILL.md such as product_description and target_audience.
  • Boundary markers: Absent; the skill uses direct interpolation for script generation.
  • Capability inventory: Executes shell commands for workspace management and accesses local configuration files.
  • Sanitization: Does not explicitly sanitize user input before it is used in the script generation prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 01:36 PM
Security Audit — agent-trust-hub — vsl-script