my-skills-maintenance

Pass

Audited by Gen Agent Trust Hub on Oct 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Employs standard developer tools including git, node, and gh (GitHub CLI) to perform repository operations, run local maintenance scripts, and manage issue trackers. It uses shell utilities like grep, sed, and tail for automated file updates in target repositories.
  • [EXTERNAL_DOWNLOADS]: Fetches the skills utility via npx at version 1.7.2 from the official NPM registry. This tool is used to distribute skills to the canonical agent store located at ~/.agents/skills.
  • [REMOTE_CODE_EXECUTION]: Executes the pinned skills package via npx to manage the installation and removal of skills in the local environment. This operation is gated by human approval and a mandatory dry-run check.
  • [INDIRECT_PROMPT_INJECTION]: Manages potentially untrusted data from upstream vendor sources and issue reports.
  • Ingestion points: Reads contents of GitHub issues via gh issue view and external skill files during vendor synchronization processes.
  • Boundary markers: Employs mandatory dry-runs and explicit user confirmation steps for all repository writes, pushes, and issue closures.
  • Capability inventory: Includes file system modifications, git operations, and execution of local maintenance scripts via node.
  • Sanitization: Relies on comprehensive post-sync verification tests (node --test) and manual review of diffs to ensure the integrity of the consolidated skill copies.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 25, 2026, 06:26 AM