skills/hopesy/skillhub/saury-revit/Gen Agent Trust Hub

saury-revit

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses user-supplied strings for project naming and output directories which are then directly interpolated into command-line templates.
  • Ingestion points: User-provided Project Name and Output Directory in SKILL.md.
  • Boundary markers: The skill lacks explicit sanitization or delimiters to prevent user-supplied strings from being interpreted as command arguments or chained commands.
  • Capability inventory: The skill uses the dotnet CLI and powershell for template management, project creation, and build operations.
  • Sanitization: Relies on user confirmation of the汇总 configuration and manual adherence to naming rules rather than automated escaping or validation.
  • [EXTERNAL_DOWNLOADS]: Downloads the official .NET installation script from Microsoft's well-known dot.net domain.
  • [REMOTE_CODE_EXECUTION]: Executes the official .NET installation PowerShell script downloaded from Microsoft to configure the development environment.
  • [COMMAND_EXECUTION]: Utilizes the dotnet CLI to perform project lifecycle operations, including installing templates and building binaries that are deployed to the system's C:\ProgramData\ directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 09:48 AM