social-presence
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs legitimate information gathering using official tools. It scans the user's own GitHub activity and public repositories associated with the author (harlan-zw) to suggest social media content.
- [COMMAND_EXECUTION]: Uses the
gh(GitHub) CLI to search for pull requests and releases. It specifically filters by the user's author tag (--author=@me) and fetches commit messages for specific repositories likenuxt-seoandunheadto provide context for tweet generation. - [DATA_EXFILTRATION]: No sensitive data access or unauthorized network transmissions were found. The skill logs its activity to
${CLAUDE_PLUGIN_DATA}/social-presence.log, which is the standard practice for plugin data persistence. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from GitHub PR titles and commit messages. While this presents a surface for indirect prompt injection (Category 8), the capabilities available to the skill are primarily read-only or limited to local logging, posing no significant risk of exploitation.
Audit Metadata