skills/jssblck/agents/here-now/Gen Agent Trust Hub

here-now

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell scripts (publish.sh and drive.sh) to interact with the here.now API. These scripts depend on standard utilities such as curl, jq, and file to perform their tasks.
  • [DATA_EXFILTRATION]: The skill is designed to upload local files and directories to a remote hosting service (here.now). This behavior is the primary purpose of the skill. The scripts include a safety mechanism that refuses to send authentication tokens if a non-default --base-url is provided without an explicit override flag.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local data (files and directory structures) for publishing. It mitigates injection risks during API communication by using jq for secure JSON construction and proper URL encoding for paths.
  • Ingestion points: Local file paths and content passed to publish.sh and drive.sh.
  • Boundary markers: The skill instructions guide the agent to perform actions only upon user request, though it does not implement specific delimiters for the processed content itself.
  • Capability inventory: The skill has the ability to read the local filesystem and perform network uploads via curl.
  • Sanitization: Data is escaped via jq and urlenc before being processed or transmitted.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 06:10 AM
Security Audit — agent-trust-hub — here-now