sub-cli
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from external Substack publications, which could lead to the agent inadvertently following instructions embedded within that data.
- Ingestion points: External data enters the agent context via the
sub-cli feed scan,sub-cli feed crawl, andsub-cli feed crawl-allcommands (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the agent when processing this external content.
- Capability inventory: The skill provides access to sensitive operations including
post publish,post delete,section remove, andsub-cli update(SKILL.md). - Sanitization: The documentation lacks explicit requirements for sanitizing or validating external content before it is used to generate or modify drafts.
- [EXTERNAL_DOWNLOADS]: The skill includes a maintenance command that fetches and installs software from a public package registry.
- The
sub-cli updatecommand is documented to install the latest npm release of the CLI tool at runtime (SKILL.md).
Audit Metadata