webinar-registration-copy
Warn
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses backticks and bash blocks in the Preamble and post-execution sections to run local binaries such as
rmbc-update-check,rmbc-analytics, andrmbc-workspace. It dynamically resolves the root path for these tools based on environment variables and standard installation paths. - [EXTERNAL_DOWNLOADS]: The skill includes an 'Inline upgrade flow' and update checks that reference external resources and scripts managed within the
$_RMBC_ROOTdirectory. It also provides a command to open a YouTube URL via theopencommand. - [DATA_EXFILTRATION]: The skill contains a backgrounded analytics command (
rmbc-analytics log) that sends metadata about skill usage, product names, and tiers. While there is a telemetry opt-in/opt-out prompt, the initial preamble attempts to run this analytics command ifanalytics_enabledis set to true (default) in the localconfig.yaml. - [PERSISTENCE_MECHANISMS]: The skill creates a hidden directory
~/.rmbc-skillsand various state files (.intro-seen,.telemetry-prompted) to track user interactions and preferences across sessions. It also usessedto modify~/.rmbc-skills/config.yamlto toggle features like analytics. - [DYNAMIC_CONTEXT_INJECTION]: The Preamble uses shell command execution to determine the environment and state before the AI processes the prompt, replacing variables and echoing status flags directly into the LLM context.
Audit Metadata