bash-lint
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill refers to official installation sources for ShellCheck and shfmt, including GitHub repositories (koalaman/shellcheck-precommit) and the Go package proxy (mvdan.cc). These are well-established sources for developer tooling.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of external shell scripts which represents an attack surface for indirect instructions embedded in code. 1. Ingestion points: The skill operates on user-supplied .sh files. 2. Boundary markers: The documentation does not specify the use of delimiters to isolate script content. 3. Capability inventory: Use of shellcheck and shfmt command-line tools. 4. Sanitization: The instructions do not include validation or sanitization of script content prior to processing.
Audit Metadata