my-skills-maintenance
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Employs standard developer tools including
git,node, andgh(GitHub CLI) to perform repository operations, run local maintenance scripts, and manage issue trackers. It uses shell utilities likegrep,sed, andtailfor automated file updates in target repositories. - [EXTERNAL_DOWNLOADS]: Fetches the
skillsutility vianpxat version 1.7.2 from the official NPM registry. This tool is used to distribute skills to the canonical agent store located at~/.agents/skills. - [REMOTE_CODE_EXECUTION]: Executes the pinned
skillspackage vianpxto manage the installation and removal of skills in the local environment. This operation is gated by human approval and a mandatory dry-run check. - [INDIRECT_PROMPT_INJECTION]: Manages potentially untrusted data from upstream vendor sources and issue reports.
- Ingestion points: Reads contents of GitHub issues via
gh issue viewand external skill files during vendor synchronization processes. - Boundary markers: Employs mandatory dry-runs and explicit user confirmation steps for all repository writes, pushes, and issue closures.
- Capability inventory: Includes file system modifications, git operations, and execution of local maintenance scripts via
node. - Sanitization: Relies on comprehensive post-sync verification tests (
node --test) and manual review of diffs to ensure the integrity of the consolidated skill copies.
Audit Metadata