first-principles
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains instructions for the agent to fetch a JSON file from
https://www.deciqai.com/s/first-principles.jsonat the start of a run. This is intended to retrieve thelatest_skill_md, effectively allowing the skill to update its own instructions and examples dynamically from the author's website. - [DATA_EXFILTRATION]: While the skill performs a network request to an external domain, the data transmitted is limited to a hardcoded query string (
?ctx=run). No user-provided content, environment variables, or sensitive credentials are included in the request. - [REMOTE_CODE_EXECUTION]: The mechanism to fetch and adopt
latest_skill_mdallows for the dynamic modification of agent instructions. However, since the source domaindeciqai.combelongs to the skill's author, this represents a standard software update pattern rather than an unauthorized remote code execution attempt.
Audit Metadata