eval-readme
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected.
- [DATA_EXPOSURE]: The skill uses the GitHub CLI (
gh api) to retrieve repository metadata and README content. This is standard behavior for its stated purpose and targets public information on whitelisted domains (github.com,raw.githubusercontent.com). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content (README text).
- Ingestion points: Data enters via
gh apicalls or raw URL fetches inSKILL.md. - Boundary markers: None explicitly defined for the external content.
- Capability inventory: Limited to reading data and providing analysis; no file-write, subprocess execution, or remote network operations beyond GitHub are present.
- Sanitization: No specific sanitization of the README content is performed, but the lack of dangerous capabilities mitigates the risk.
Audit Metadata