tool-install
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data from external URLs via
fetch_contentandweb_searchto determine installation steps. - Ingestion points: The workflow fetches user-provided links to research tool descriptions and installation methods (Step 1 in SKILL.md).
- Boundary markers: The skill includes an explicit approval gate requiring the user to reply with "approve" or "go" before any mutation occurs. It also utilizes
plannotator --gateif available. - Capability inventory: The agent can execute shell commands, modify shell configuration files (e.g.,
.zshrc), and install background services (LaunchAgents/LaunchDaemons). - Sanitization: No explicit sanitization or filtering of external content is described; the agent relies on its own "research" to interpret the data.
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands to inspect the system environment, perform installations, and verify success.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch metadata from user-specified URLs and download software packages via package managers like Homebrew, npm, pip, and cargo.
Audit Metadata