supply-chain-review
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill consists entirely of markdown instructions and configuration files. It contains no scripts, executables, or tool-calling logic, posing no direct execution risk.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted third-party content, such as skill sources and dependencies. While this defines an ingestion surface for potential indirect prompt injection, the skill lacks the capabilities (like file writing, network access, or command execution) required for an exploit to be impactful. Furthermore, it includes explicit safety instructions (e.g., "Do not install or execute third-party packages just to inspect them") to mitigate these risks.
- [COMMAND_EXECUTION]: There are no shell commands, subprocess calls, or dynamic execution patterns present in the provided files.
Audit Metadata