skills/cometworks/skills/se-dev-torch/Gen Agent Trust Hub

se-dev-torch

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches a pre-compiled busybox executable for Windows from https://frippery.org/files/busybox/busybox64u.exe to provide UNIX-like shell commands during preparation.
  • [REMOTE_CODE_EXECUTION]: Downloads and executes an installation script from https://astral.sh/uv/install.sh to provision the uv Python package manager. This is the official installation method for the tool.
  • [COMMAND_EXECUTION]: The skill orchestrates environment setup and indexing via Prepare.bat and Prepare.sh, using uv run for Python execution and BusyBox for cross-platform shell consistency.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it parses and displays external C# code from the Torch repository.
  • Ingestion points: index_torch.py and search_torch.py read source files from the locally cloned TorchAPI/Torch repository.
  • Boundary markers: None; search results are displayed without specific delimiters or safety warnings.
  • Capability inventory: The skill has shell command execution capabilities through its provided Bash tools.
  • Sanitization: Content from the framework source code is indexed and displayed without sanitization of comments or metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 12:35 PM
Security Audit — agent-trust-hub — se-dev-torch