ht-scan-project
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the latest hackathon data from the developer's official API and downloads installation components from the author's GitHub repository. These operations target the developer's own infrastructure for core functionality.
- [COMMAND_EXECUTION]: The tool uses standard shell commands like curl, ls, and cat to retrieve competition data and inspect project files. It also uses the open command to launch the browser for specific hackathon registration pages upon user request.
- [REMOTE_CODE_EXECUTION]: Although automated scanners flagged a command piping output to a Python interpreter, manual review confirms this is a safe JSON processing operation using Python's inline command capability to parse and filter competition data, rather than an execution of untrusted remote scripts.
- [PROMPT_INJECTION]: The skill reads external data from the local project files. While this creates a surface for indirect prompt injection, the skill is designed to extract technical metadata, and its structured matching logic provides resilience against instructions embedded within project documentation.
Audit Metadata