onboard
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a standard onboarding workflow for a video plugin. It correctly scopes its operations to the local user data directory.
- [COMMAND_EXECUTION]: Utilizes local bash utilities such as mkdir, cp, and jq for file and directory management. These operations are used to organize presets and maintain the preferences.json file.
- [DATA_EXPOSURE]: Reads and writes local configuration data. There are no patterns indicating credential harvesting or data exfiltration to external domains.
- [PROMPT_INJECTION]: The skill includes an interface for processing user-provided files to detect EQ formats. This represents a potential surface for indirect prompt injection, though handled safely in this context. 1. Ingestion points: User-specified file paths ($PATH_) in the EQ preset registration step (SKILL.md). 2. Boundary markers: None explicitly defined in the provided scripts. 3. Capability inventory: File system operations (cp, mkdir) and JSON processing (jq) listed in SKILL.md frontmatter. 4. Sanitization: Uses jq to validate the internal structure of provided files before assigning a format label.
Audit Metadata