skills/gitbobobo/skills/fast-ship/Gen Agent Trust Hub

fast-ship

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions define a specific 'Additional Block' format and direct the agent to automatically process project and issue IDs found within these blocks without further user confirmation.
  • Ingestion points: Data blocks appended to prompt templates as described in SKILL.md.
  • Boundary markers: Content is delimited by specific introductory text and markdown block quotes (>).
  • Capability inventory: The scripts/fast-ship-api.mjs script enables full REST API interactions including issue creation, modification, and deletion.
  • Sanitization: The skill requires writing request bodies to JSON files to avoid shell-related injection issues via command-line arguments.
  • [EXTERNAL_DOWNLOADS]: The documentation provides a command to install the skill via npx skills add from a GitHub repository (https://github.com/gitbobobo/fast_ship). This repository is owned by the skill author ('gitbobobo') and represents a vendor resource.
  • [COMMAND_EXECUTION]: The skill suggests a fallback mechanism using curl with temporary header files to manage API credentials securely during network operations.
  • [CREDENTIALS_UNSAFE]: The scripts/fast-ship-api.mjs script reads API credentials from ~/.config/fast-ship/config.yaml. While this is standard practice for CLI-based API clients, it involves accessing a sensitive configuration file containing an API key.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 12:27 PM